Exif Executor

Exif executor is a "failsafe" bot for Matrix. It is designed to sit in a room, observe image uploads, and automatically redact (or at least alert) if the image contains any GPS data in exif.

Why? Sometimes, clients don't properly strip exif data when sending. For example, sharing from Google Photos to Element X Android is known to bypass exif stripping altogether. However, the bot is also more just as a peice of mind - you and your room members can feel safer sharing images without having to worry about if they're unknowingly leaking their location.

How? The bot will listen for m.room.message events with the m.image msgtype, download them to memory, parse exif data, and if it detects GPSData is present and populated, it will try to redact the message, and if that fails, it will just add a reaction. As images are only stored in memory, they're never kept in a persistent state.

How to use

There is an instance of this bot that I run myself. Just invite @exif-executor:nexy7574.co.uk instead of your own instance below.

1. Set up the bot on your server (see below)
2. Invite the bot to your room
3. The bot will automatically start monitoring the room
4. Give the bot the power level necessary to redact messages (usually 50)

Your room is now fully protected from exif data leaks!

Commands

There are some commands for the bot:

• ?ping - Check if the bot is alive
• ?help - Get a list of commands
• exif dump - When replying to an image, the bot will dump the exif data to the room. Also manually triggers a leak check.

Installing & Running

You can use docker:

docker run -it --name exif-executor --restart unless-stopped -d -v $(pwd)/config.toml:/app/config.toml codeberg.org/nexy7574/exif-executor:dev

or

services:
    exif-executor:
        image: codeberg.org/nexy7574/exif-executor:dev
        volumes:
            - ./config.toml:/app/config.toml
        restart: unless-stopped

You can change dev to latest and vice versa. Stable releases are tagged, so check the releases tab.

Or you can just run it with your favourite shell:

python3 src/main.py

Offline leak checking

You can test that the bot will detect exif data correctly by passing a file path to the first stdin argument:

python3 src/main.py $HOME/Downloads/exif.png

This will print True/False to stdout depending on if the image contains GPS data, and will dump the exif data to the console.

Having trouble?

Do not hesitate to open an issue, or join #general:nexy7574.co.uk and ask me for help.