CODEWITHSUNDEEP
phpsecurityimagesrc
Filippo oretti
Filippo oretti

Reputation: 49813

Src images and security

What about if I let users insert links to their own host's images, do I need to prevent any type of security issue?

To better exaplain, <img src="somedomain/somefile"/> in which case should make my site vulnerable?

Upvotes: 3

Views: 2214

Answers (2)

BenSwayne
BenSwayne

Reputation: 16910

Also if you're doing a simple string insertion into your markup someone could close the image tag and start a script tag or something like that. So you should be watching for script injection in whatever form the user gets to set such an image src attribute.

For example what if the image src was set to this:

myimagefile.jpg" /><script> ... </script>

You can see how that would get rid of the image tab altogether and start doing something else in a script tag. You need to make sure whatever they enter actually points to an image before you save it and start writing it out on live pages.

This style of script injection could for example read from a form on the page (maybe including personal information, login details, or session ids) and send end users info back to some bad hackers data collection point using jsonp.

Upvotes: 3

Pekka
Pekka

Reputation: 449485

One potential problem with allowing arbitrary image URLs is that the image's host could track all views and IP addresses. In a forum with little traffic that could put the image host in the position to identify specific users' IP addresses.

Another is that you don't control what is shown in the image. An image resource could be dynamic and show pretty much anything at any given time to any user.

Then there's the very remote risk of an image exploiting a vulnerability in a visitor's browser or image library. But those are exceedingly rare and likely to get patched quickly - I myself know of only one instance this has happened on a larger scale.

Stack Overflow with is massive reach and traffic still allows external images - from that I tend to deduce that the risks are somewhat manageable.

Still, if you want to make really sure, you're best off fetching the image resource, copying it using an image library (to make sure it's a real image and to strip any sensitive metadata), and storing it on your server.

Upvotes: 5

Related Questions