fix: pin the Imagick coder per provider without a temporary file (OC10-164)

[oc-tmueller]

Summary

Implements Florian's coder-pinning fix for OC10-164 entirely in memory. Replaces #41832, which does the same pinning but needs a temporary file per preview (and a new /dev/shm-backed ITempManager::getRamTemporaryFile() to make that affordable).

Stacked on #41827's branch rather than master, since it touches the same files. This is a sibling of #41832, not a follow-up — #41832 will be closed.

Why #41832 needed a temp file, and why it turns out it doesn't

#41832 pins via readImage('TIFF:/path'), which needs a real filesystem path, because setFormat() + readImageBlob() appeared to pin correctly but skip rasterization — getImageBlob() handed back the original, undecoded bytes.

That diagnosis was wrong. setFormat() does fully decode. It also sets the wand's output format, so getImageBlob() was faithfully re-encoding back to the pinned input format, and setImageFormat('png') alone could not override it. For TIFF and SGI that re-encode is byte-identical to the input, which is exactly why it looked like untouched passthrough. PSD was the tell: 15016 bytes out for a 14988-byte input.

The fix is one extra call — setFormat('png') on the wand alongside setImageFormat('png') on the image.

Verified on two builds, comparing pinned geometry against an unpinned read as ground truth:

	ImageMagick 6.9.11-60 / imagick 3.8.1 / PHP 8.3	ImageMagick 7.1.1-36 / imagick 3.7.0 / PHP 7.4
tiff/psd/sgi/ai/heic/ttf decode	geometry matches unpinned	geometry matches unpinned
MVG / MSL / PostScript via a foreign pin	rejected	rejected

Why removing the temp file matters

/dev/shm is 64 MB by default in both owncloud/server:10.15.0 and owncloudci/php:8.3 (measured), deployments routinely set it smaller, and preview_max_filesize_image defaults to 50 MB. A full tmpfs makes file_put_contents() short-write, and readImage('TIFF:…') frequently succeeds on a truncated TIFF/PSD/SGI stream — so a partially rendered image would be written to the preview cache and served from then on. There is no way to detect that from is_dir()/is_writable(), since a full tmpfs at mode 1777 is still writable.

Not writing the file at all removes that failure mode rather than hardening it, and with it the ramtempdirectory config surface, the OCP\ITempManager addition (a BC break in a patch release), and the tmpfs leak that cleanOld() could not sweep.

What changed

• Bitmap::getResizedPreview() takes the file's own mime type, calls setFormat($this->getImagickFormat($mimeType)) before readImageBlob(), and resets both output formats afterwards.
• New abstract protected getImagickFormat(string $mimeType): string with one implementation per provider.
• SVG.php gets the same pin, Office.php keeps pinning through its constructor argument.
• Deliberately not guarded by queryFormats() in Bitmap: if a build does not register a provider's coder, throwing is correct — the only alternative is the content-sniffing the pin exists to prevent. SVG.php is guarded, because a build with no SVG coder cannot decode SVG either way and what it pins is DOMSanitizer output, not raw bytes.
• Heic pins HEIC for both image/heic and image/heif. They are one container handled by one coder module, and pinning HEIF broke .heif previews on every build that registers only HEIC — including owncloudci/php:8.3.

Diff is +89/-4 across 11 source files, and it is PHP 7.4-clean, so the pending 10.16 backport (#41828) needs no syntax changes.

Tests

CoderPinningTest asserts both halves of the pin, with six new fixtures (tests/data had no .ai/.heic/.psd/.sgi/.tiff/.ttf sample at all). The HEIC fixture is AVIF-encoded on purpose — ImageMagick classifies the avif brand as HEIC, and an HEVC sample needs a libde265 delegate that is not present everywhere.

These skips are now per-coder, which fixes a real gap. The tests this file is modelled on gated every case on Imagick::queryFormats('SVG') as a stand-in for "this build has the extended coder set" — but owncloudci/php:8.3 registers no SVG coder, so the whole file skipped and the assertions never ran in CI. Each case now requires only the coder it exercises. On owncloudci/php:8.3 the result is 15 tests executing rather than skipping, including the image/heif case. SanitizeTest's guard likewise moves to the PDF/TTF coders its providers actually use; it deliberately does not require an SVG coder, since the point of those cases is that the content never reaches Imagick.

Known residuals (unchanged, pre-existing)

• AI/PDF/EPS accept PostScript content — same Ghostscript family, so it is not foreign to them. Bounded to those three providers and mitigated by fix: harden ImageMagick policy and install rsvg-convert (OC10-164) owncloud-docker/php#309's policy.xml, which denies MVG/MSL/MSVG regardless of entry point.
• TTF/PFB accept non-font bytes, but the TTF coder is what runs: the output is the same 800x480 font specimen sheet a real TTF produces, so there is no coder handoff. Covered by testFontNeverInvokesADangerousCoderForForeignContent.
• abstract protected getImagickFormat() is a load-time fatal for any out-of-tree OC\Preview\Bitmap subclass. Bitmap is lib/private, and the compile-time guarantee that every provider declares its coder seems worth more — flagging it as the one deliberate BC risk.

Verification

• tests/lib/Preview/ + TempManagerTest + PreviewManagerTest on a fresh owncloudci/php:8.3: 73 tests, 171 assertions, 0 failures. The only skips are pre-existing PDFTest/SVGTest ones.
• php-cs-fixer with the ownCloud standard: 0 of 41 files need fixing.
• php -l under PHP 7.4 for every changed file.
• Pin matrix re-run against the patched mapping on both builds: all formats to PNG, MVG/MSL/PostScript rejected by every non-Ghostscript pin.

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.