27

I know, I know, title is quite bad, but I'll try to explain what I mean here. So, I ask my members to show their photos. They upload it somewhere, then paste their photos' URL into input and I save it to my database (MYSQL). Then, the photo is being seen on their profiles. I get the URL from database and do something like that: <img src="<?=$photo;?>" height="123px" width="123px">"> where $photo is URL taken from MYSQL. Is it totally safe? Can somebody upload for example .php file and harm my website? Do I need to check if URL's ending is .gif, .png, .jpg?
Thank you.

Edit: Yeah, of course I would protect my website from SQL injections and XSS attacks. But is there any way to harm my website in other way?

5
  • 3
    Before inserting into the db, use imagemagik to validate that the photo is a real image, not something else, and you should be OK. Jun 24, 2010 at 22:24
  • "Is it totally safe?" It is totally unsafe :) All kinds of xss attack is possible here if not others. @Byron That's good way, assuming that imagemagick is safe, but if it's not a banking site then this is not a real threat.
    – kubal5003
    Jun 24, 2010 at 22:26
  • <img src="<?=htmlspecialchars($photo);?>" height="123px" width="123px">">. This doesn't protect against XSRF, however (e.g., a user putting in /logout.php as the image URI would probably be a bad thing) Jun 25, 2010 at 0:54
  • 3
    @Byron: even if the image were valid when the script checks, it'd be trivial to replace the photo later at the image host with something malicious.
    – Marc B
    Jun 25, 2010 at 2:23
  • @Marc, Correct. I thought he was downloading the image source into the db and serving bytes. Jun 25, 2010 at 20:39

12 Answers 12

12

What you described may be vulnerable to an XSS (Cross-site Scripting) attack. Essentially, a nefarious user may be able to inject javascript code that could do bad things, while executing as your site.

For an example of this attack vector, check out: http://jarlsberg.appspot.com/part2#2__stored_xss_via_html_attribute

EDIT: It sounds like you are already protecting yourself agains SQL injections and XSS, and you are wondering if there is some way for someone to inject PHP code into your site. I don't think this is possible, since your server-side code will not be executing this string. You are simply instructing the client browser to download an image from a URL.

It may be possible for someone to link to an image file that is infected with a virus, which would then infect other visitors to your site, but it would not affect the site itself.

1
  • I'm glad I could help. If you feel this best answers your question, please consider marking it the 'accepted' answer by clicking the check mark next to it.
    – pkaeding
    Jun 25, 2010 at 0:19
12

No, it's not safe at all, XSS attacks can be executed through image tags.

A simple example would be:

<IMG SRC=j&#X41vascript:alert('test2')>

http://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

7
  • This is assuming users have control over what their image is named when it is being served. Jun 24, 2010 at 22:42
  • What browsers is this alert box meant to work on? Nothing happens in IE or Firefox when I try? Jun 24, 2010 at 22:45
  • 1
    Quick example here: jsbin.com/avuda it doesn't work in Firefox, IE 8, or Chrome
    – Earlz
    Jun 24, 2010 at 23:13
  • 1
    @Stuart: The question says the user provides a URI, not a file, so they have total control.
    – Quentin
    Jun 24, 2010 at 23:14
  • 3
    @Martin: Recent versions of most browsers explicitly reject javascript URIs for images now — there are still vulnerable ones out there though.
    – Quentin
    Jun 24, 2010 at 23:15
6

One thing you should consider - I could link you my "XUltra highres" image with about 200 megs. I guess this could break the loading experience of your site (depending on the design). So beside "script attacks" is allowing users to link content into your site always problematic.

5

A couple of things to do are to validate that it is a real image in an accepted format (tpyically jpg,png and gif), and sanitize and change the filename.

You can use the PHP getimagesize function to check if it's a valid picture, and which format. You receive the alleged MIME type when the file is uploaded, but that is useless for validation. So, the following should work as the getimagesize function also validates images and returns the exif type.

$image_info=getimagesize($tempname);

$allowed_types=array(IMAGETYPE_PNG,IMAGETYPE_JPEG,IMAGETYPE_GIF);//these are actually the integers 1, 2 and 3

if(in_array($image_info[2],$allowed_types)){
   //image is a valid image. You can also check the height and width.
   }

In your upload processing, giving your file a new unique name that you have chosen is a good idea, and then you don't have to worry about them doing anything strange with the filename.

Edit: I noticed you are referring to users supplying a URL to an image.

The answer I gave related to accepting, storing and displaying images users upload to your server.

The same principles apply, though, for displaying a URL of an image. You can get the image via cURL or fopen, save it to a temp file, and then check if it's really an image as described above. This can also catch the user linking to a non-existant or invalid image, so you could warn them. Also, enforce a filesize/dimension limit - you don't want someone linking to a 5 GB picture in their profile (though it would be their own bandwidth problem) as that could inconvenience your other users. The user could always change the file to something else later on, though. You could check once every x hours and warn people who are doing something suspicious, but that seems like a lot of effort on your end.

You can also enforce file name rules, say no unicode in file names, and the name must not include <>''""# -, which are characters that are rarely in legitimate image URLs.

4

Strictly speaking - yes. I can post an image in your site that is hosted by my server.

<img alt="Kobi's Photo" src="http://example.com/photo.jpg" />

Seems innocent enough, but in fact, every visitor in your site, watching my image, can be tracked and recorded. Every visitor will get a session in my server, and and can even be given a cookie (not the fun kind). To make things even worse, I can track every page view of your visitors that displays my photo - the browser sends each url where the photo is display via the referer header.
By letting people hosting their own photos, you give away some privacy of your visitors.

3

Assuming you're already sanitizing for SQL injection. You need to prevent the user from doing something like this:

<img src="http://usmilitary/launchAllNukes?When=Now" />

or:

<img src""<script>//Evil code</script>" height="123px" width="123px" />
2
  • 2
    As for the first example, there's no way to validate stuff like that without going to the site and seeing what's there. That, and anyone who does irreversible and consequential stuff in response to a GET query deserves what they get. (There's rules that say you should use POST for that.) The second example would be defeated by simply HTML-escaping the "url" before it's output.
    – cHao
    Jun 24, 2010 at 22:38
  • @cHao True. My point is that he needs to first SQL escape the url before putting it in the DB, then HTML escape it before putting it out in the HTML page, and finally you might consider first testing the url to ensure it returns an image (possibly making sure it is of a reasonable size). You are correct of course that it is the destination site's responsibility to make sure it only makes changes on POST not GET, but not all do that so theoretically something bad can happen with this process.
    – Adam
    Jun 24, 2010 at 22:49
2

There's no point in checking the file extension, as that doesn't guarantee it's not processed by a script. GET requests (as used by img src) should be safe, and should not cause a major state change (e.g. purchase, delete user, etc.). However, there are buggy sites that do so.

Thus, the safest solution is to require users to upload the image to your site. If you do allow remote images, you should at least require the http or https scheme.

2

Before inserting into the db, use imagemagik to validate that the photo is a real image, not something else, and you should be OK.

2
2

If you allow users to specify any URL as a profile image, an attacker could exploit that to facilitate a denial of service attack against a smaller website. Its impact to the targeted website is equivalent to being slashdotted. For example, an attacker could change his/her profile picture URL to a large resource hosted on the targeted website. Each time a visitor to your site sees the attacker's profile, the targeted website wastes bandwidth serving the resource to the visitor.

A solution to this would be to only allow profile picture URLs that link to image hosting sites.

1

By uploading "somewhere", will you be hosting the files on your webserver?

There are lots of potential issues:

<img src="http://hacker.ru/badtimes.php" />
<img src="javascript:alert(String.fromCharCode(88,83,83))" />

Plus, specially-crafted jpgs can infect users machines:
https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2004/ms04-028

2
  • 1
    Ok, let's assume they put URL like this <img src="http://hacker.ru/badtimes.php" />, what can it do to my site? Jun 24, 2010 at 22:48
  • The damage is not to your site, but to your users. Imagine you've signed in into your bank and then a malicious actor is able to embed this image in your website so all your visitors load it. Now, imagine that the malicious image is something like this instead <img src="http://yourbank.com/transfer?to=maliciousaccount&amount=100 />
    – Juanda
    May 21, 2020 at 19:38
0

Besides what the others have said regarding nefarious intentions, the only other issue I can see is if the image is of something really horrible, but then that can happen on any website where you can upload images.

If you actually allow the users to upload images, you can check the mime type (PHP's getimagesize() function can give you this information). This is not bulletproof either, but better than just checking the extension.

-2

You could use a regular expression to filter the url in the PHP. That way you could prevent javascript tags being called and specify the valid file extensions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.