MM-67077: Remove PSD file previews (#34898) (#35000)

Automatic Merge

server/channels/app/imaging/decode.go

@@ -13,7 +13,6 @@ import (
 	"io"
 	"sync"
 
-	_ "github.com/oov/psd"
 	_ "golang.org/x/image/bmp"
 	_ "golang.org/x/image/tiff"
 	_ "golang.org/x/image/webp"

server/channels/app/imaging/decode_test.go

@@ -115,6 +115,20 @@ func TestDecoderDecode(t *testing.T) {
 	})
 }
 
+func TestPSDNotSupported(t *testing.T) {
+	// MM-67077: PSD preview support was removed due to memory vulnerability in oov/psd package
+	d, err := NewDecoder(DecoderOptions{})
+	require.NotNil(t, d)
+	require.NoError(t, err)
+
+	// PSD file header magic bytes: "8BPS" followed by version (0x0001 for PSD)
+	psdHeader := []byte("8BPS\x00\x01")
+	_, _, err = d.Decode(bytes.NewReader(psdHeader))
+
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "unknown format")
+}
+
 func TestDecoderDecodeMemBounded(t *testing.T) {
 	t.Run("concurrency bounded", func(t *testing.T) {
 		d, err := NewDecoder(DecoderOptions{