CODEWITHSUNDEEP
phpcurlthumbnails
Thomas Decaux
Thomas Decaux

Reputation: 22711

Generate thumbnails from untrust remote images

I am doing a simple thumbnail generator, no problem to generate the thumbnail, I am using PHP, file_get_contents to get the remove image content.

I am wondering if there is some security issue to download the file content like this (with cURL or file_get_contents).

  1. How can I limit the file size and stop the download at X Mo?
  2. How can I check the binary content has no dangerous code?
  3. Maybe there is another technologie than PHP fitting my needs?

Thanks

Upvotes: 0

Views: 217

Answers (1)

Thomas Decaux
Thomas Decaux

Reputation: 22711

Here a piece of code I will test:

curl_setopt($cURL_Handle, CURLOPT_BUFFERSIZE, 128);
curl_setopt($cURL_Handle, CURLOPT_NOPROGRESS, false);
curl_setopt($cURL_Handle, CURLOPT_PROGRESSFUNCTION, function(
    $DownloadSize, $Downloaded, $UploadSize, $Uploaded) {
    // If $Downloaded exceeds 1KB, returning non-0 breaks the connection!
   return ($Downloaded > (1 * 1024)) ? 1 : 0;
});
curl_setopt($cURL_Handle, CURLOPT_WRITEFUNCTION, function(
    $ch, $str) {
    // Grab the first bytes, check if match a image "header signature"
});

Upvotes: 0

Related Questions