IssueTracker

We use ImageMagick image processing software with Cloud Functions (nodejs v10) to convert PDF files to JPG files, which works fine on local setup with Functions emulator. However the very same process fails when code is deployed.

Functions log following error to stderr:
stderr: 'convert-im6.q16: not authorized `/tmp/dummy.pdf\' @ error/constitute.c/ReadImage/412.\nconvert-im6.q16: no images defined `/tmp/dummy.jpg\' @ error/convert.c/ConvertImageCommand/3258.\n'

After some debugging it would seem that this is caused by permissions set to ImageMagicks being too strict. This is probably due to severe security vunerability that package called Ghostscript had. ImageMagicks uses Ghostscript behind the scenes to process PDF files.

Due to Ghostscript's severe security vunerability ImageMagick shipped with restricted access to PDF files. However, as stated by creator of ImageMagick these restrictions can be relaxed if Ghostscript version 9.25 or newer is installed (see http://www.imagemagick.org/discourse-server/viewtopic.php?t=35300 and https://stackoverflow.com/questions/52861946/imagemagick-not-authorized-to-convert-pdf-to-an-image/52863413#52863413).

GCF uses Ghostscript version 9.26 (2018-11-20), as logged by using command "gs -h". Therefore PDF restrictions could be relaxed and it would allow to rasterize PDF files on GCF via ImageMagick. Permissions are stored in policy.xml file (in /etc/ImageMagick-6/policy.xml I believe). Required changes would be:

Change:
<policy domain="coder" rights="none" pattern="PS" />
<policy domain="coder" rights="none" pattern="EPS" />
<policy domain="coder" rights="none" pattern="PDF" />
<policy domain="coder" rights="none" pattern="XPS" />

To:
<policy domain="coder" rights="read|write" pattern="PS" />
<policy domain="coder" rights="read|write" pattern="EPS" />
<policy domain="coder" rights="read|write" pattern="PDF" />
<policy domain="coder" rights="read|write" pattern="XPS" />


Cloud Function code to reproduce issue:
const admin = require('firebase-admin');
const path = require('path');
const os = require('os');
const spawn = require('child-process-promise').spawn;

const dummyPdfPath = path.join(os.tmpdir(), 'dummy.pdf');
const imageFilePath = path.join(os.tmpdir(), 'dummy.jpg');

// admin.initializeApp(...);

// dummyPdfPath can be replaced with absolute path to PDF in local environment, storage bucket download is used just for easy access to PDF when function is deployed
await admin.storage().bucket().file('dummy.pdf').download({
        destination: dummyPdfPath
})

await spawn(
        'convert',
        [dummyPdfPath, imageFilePath],
        {capture: ['stdout', 'stderr']}
);