Decompression bomb protection in image viewing

boards/models/attachment/viewers.py

@@ -1,5 +1,7 b''
 import re
 
+from PIL import Image
+
 from django.contrib.staticfiles import finders
 from django.contrib.staticfiles.templatetags.staticfiles import static
 from django.core.files.images import get_image_dimensions
@@ -145,7 +147,15 b' class ImageViewer(AbstractViewer):'
     def get_format_view(self):
         metadata = '{}, {}'.format(self.file.name.split('.')[-1],
                                    filesizeformat(self.file.size))
+
+        Image.warnings.simplefilter('error', Image.DecompressionBombWarning)
+        try:
         width, height = get_image_dimensions(self.file.path)
+        except Exception:
+            # If the image is a decompression bomb, treat it as just a regular
+            # file
+            return super().get_format_view()
+
         preview_path = self.file.path.replace('.', '.200x150.')
         pre_width, pre_height = get_image_dimensions(preview_path)