CODEWITHSUNDEEP
imagesecuritydata-uri
sbrian
sbrian

Reputation: 229

Attacks using data URI scheme and img tags

Is anyone aware of any security issues with the use of <img src="data:xxxxx"> where the user supplies the content? Assume the content is validated so it fits the format for a data URI so it can't break out of the tag, and is also restricted to image mime types.

http://en.wikipedia.org/wiki/Data_URI_scheme

Upvotes: 2

Views: 1108

Answers (2)

Gumbo
Gumbo

Reputation: 655239

I think this should be secure. As the data URI syntax for images is quite strict:

data:image/<subtype>;base64,<base64-stream>

it would be easy to validate (see for example RegEx to parse or validate Base64 data).

The only vulnerability I can think of is one within the component that parses/renders the image.

Upvotes: 1

sblom
sblom

Reputation: 27343

There's definitely different code involved, but it's probably not any more attackable than a normal img link.

Upvotes: 2

Related Questions