Image file metadata and the `better-img-uploads` addon about scratchaddons

[OneShot-Niko]

shouldnt this be reported as a security vulnerability instead of made as a normal issue?

[DNin01]

I remember that metadata of audio files (artists, year, etc.) is preserved when uploaded into a project, and anyone can see it by exporting and downloading the audio track from the project. I haven't checked if the same applies to images or SVGs.

We can't really do anything if that is the case, other than maybe make an addon that omits metadata from all uploads?

[WorldLanguages]

Can you check?

[DNin01]

Can you check?

I uploaded (normally) a JPEG image with an author and copyright specified and the metadata was not present in the exported file.

I was able to get the metadata by decoding the base64 of the image in the SVG file when uploading it with the HD uploads addon, so this issue can be confirmed.

[BroJac5246]

This seems dangerous, given that Scratch is targeted at kids. The priority should always be user safety, so I think we should fix this ASAP.

We could also consider adding a separate addon that removes metadata from sounds and maybe even existing images.