To be safer, whitelist, not blacklist. Hr program should analyze a photo, and emit a new graphical image computed from then original's color data only, and not pass through any metadata.