New answers tagged file-upload
2
What's wrong with SFTP? You can mount it as a drive if WinSCP isn't enough and they really must have it look like a Windows folder.
5
The IMG tag will attempt to interpret the data as an image, so Javascript won't be executed.
It will be possible to send an image that, once decoded, will require enormous amounts of memory ("PNG bomb"), and it is possible that the graphic routines themselves are vulnerable to malicious content (a carefully crafted image that, when decoded, triggers ...
3
JavaScript itself won't be executed, even if the remote server changes MIME Content-Type to text/javascript, because the browsers will aready expect certain MIME types within the IMG tag. That doesn't really mean they're safe to use, though.
One thread I suggest you read is is it safe to allow external images to be attached to Blog or any Web content?. In ...
22
There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...
4
Yes, you are safe.
Of course, the page you get served when you Right click > View Image could be malicious, but no script will be executed in the context of your website.
Moreover, don't forget that the owner of the website of the image can track your visitors on all pages where the image is embedded.
Top 50 recent answers are included
