$NetBSD: patch-config_policy.xml,v 1.12 2022/10/03 12:55:13 wiz Exp $

Update default policies for better resistance to untrusted input.

Discussion:
http://mail-index.netbsd.org/tech-pkg/2021/04/03/msg024740.html

--- config/policy.xml.orig	2022-09-24 14:42:19.000000000 +0000
+++ config/policy.xml
@@ -76,6 +76,30 @@
   <!-- <policy domain="cache" name="synchronize" value="True"/> -->
   <!-- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> -->
   <!-- <policy domain="system" name="max-memory-request" value="256MiB"/> -->
+
+  <!-- 
+    -- Disable ghostscript decoders as suggested by VU#332928
+    --  <https://www.kb.cert.org/vuls/id/332928>
+    -->
+  <policy domain="coder" rights="write" pattern="PS" />
+  <policy domain="coder" rights="write" pattern="PS2" />
+  <policy domain="coder" rights="write" pattern="PS3" />
+  <policy domain="coder" rights="write" pattern="EPS" />
+  <policy domain="coder" rights="write" pattern="PDF" />
+  <policy domain="coder" rights="write" pattern="XPS" />
+
+  <!-- Recommended policies from <https://imagetragick.com/> -->
+  <policy domain="coder" rights="none" pattern="EPHEMERAL" />
+  <policy domain="coder" rights="none" pattern="URL" />
+  <policy domain="coder" rights="none" pattern="HTTPS" />
+  <!-- breaks deforaos-icon-theme package -->
+  <!--<policy domain="coder" rights="none" pattern="MVG" />-->
+  <policy domain="coder" rights="none" pattern="MSL" />
+  <policy domain="coder" rights="none" pattern="TEXT" />
+  <policy domain="coder" rights="none" pattern="SHOW" />
+  <policy domain="coder" rights="none" pattern="WIN" />
+  <policy domain="coder" rights="none" pattern="PLT" />
+
   <!-- <policy domain="cache" name="synchronize" value="true"/> -->
   <!-- <policy domain="system" name="shred" value="1"/> -->
   <!-- <policy domain="system" name="font" value="/path/to/unicode-font.ttf"/> -->