Building a website, I'd like to allow users to specify an url that point to an image that will be used as a profile picture (included in the HTML DOM as a ).
But before doing anything stupid, I was wondering if it was possible for an malicious person to use this for other purposes.
From what I know, it can possible to specify a .php file (for example), that will read the cookie session, and then display the image. But I don't have anything risky stored in the cookie.
What else can be done and is this a very (very very) bad choice or can I go with it?
I found that IE6 had a problem with this that could lead to an XSS exploit, but well, it's IE6, written in 1874 right? (spoiler: I don't target IE6 users at all ;) )
Thanks for your help.