I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic that No Users shall be Upload any Image to the Profile picture just for Testing and instead of that i am showing Images like <div style="background-image: url("http://example.com/image.jpg")></div>

In this i have made a Input for user to place the path of jpg image from any site he likes and I directly display the image from that site only, which is http://example.com/image.jpg in our case.

I want to consider the worst situation here, I haven't placed check nor whitelisted any domains into the example.com/image.jpg. I placed a URL like http://stackoverflow.com/index.html it shows me blank, I tried many PHP scripts like http://attacker.com/omg.php and it doesn't run the script on my domain.

Is there any possibility of attack vector here? If yes, kindly suggest me. And also is CORS or SOP Bypass possible here, I have CSP protection of the domain.

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic that No Users shall be Upload any Image to the Profile picture just for Testing and instead of that i am showing Images like <div style="background-image: url("http://example.com/image.jpg")></div>

In this i have made a Input for user to place the path of jpg image from any site he likes and I directly display the image from that site only, which is http://example.com/image.jpg in our case.

I want to consider the worst situation here, I haven't placed check nor whitelisted any domains into the example.com/image.jpg. I placed a URL like http://stackoverflow.com/index.html it shows me blank, I tried many PHP scripts like http://attacker.com/omg.php and it doesn't run the script on my domain.

Is there any possibility of attack vector here? If yes, kindly suggest me. And also is CORS or SOP Bypass possible here, I have CSP protection of the domain.

Note: In the URL Section, i am making First validating check at scheme of URL where http:// , // and https:// are WhiteListed & in the Image section i have ONLY whitelisted Numbers + Alphabets and special characters like ., - & / .Rest else are blocked

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic that No Users shall be Upload any Image to the Profile picture just for Testing and instead of that i am showing Images like <div style="background-image: url("http://example.com/image.jpg")></div>

In this i have made a Input for user to place the path of jpg image from anysite he likes and i directly display the image from that site only, which is http://example.com/image.jpg in our case.

Now, i want to consider the Worst situation here, i haven't placed check nor whitelisted any Domains into the example.com/image.jpg .. Now i placed a url like http://stackoverflow.com/index.html it shows me blank  , i tried many php scripts like http://attacker.com/omg.php and it doesn't runs the script on my domain ..

Now, Is there any Possibility of Attack vector here, If yes, kindly suggest me. And also is CORS or SOP Bypass possible here, I have CSP protection of the domain.

If i missed any info, you can ask me in comment. :)

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic that No Users shall be Upload any Image to the Profile picture just for Testing and instead of that i am showing Images like <div style="background-image: url("http://example.com/image.jpg")></div>

In this i have made a Input for user to place the path of jpg image from any site he likes and I directly display the image from that site only, which is http://example.com/image.jpg in our case.

I want to consider the worst situation here, I haven't placed check nor whitelisted any domains into the example.com/image.jpg. I placed a URL like http://stackoverflow.com/index.html it shows me blank, I tried many PHP scripts like http://attacker.com/omg.php and it doesn't run the script on my domain.

Is there any possibility of attack vector here? If yes, kindly suggest me. And also is CORS or SOP Bypass possible here, I have CSP protection of the domain.

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic that No Users shall be Upload any Image to the Profile picture just for Testing and instead of that i am showing Images like <div style="background-image: url("http://image.com/image.jpg")></div>

In this i have made a Input for user to place the path of jpg image from anysite he likes and i directly display the image from that site only, which is http://image.com/image.jpg in our case.

Now, i want to consider the Worst situation here, i haven't placed check nor whitelisted any Domains into the image.com/image.jpg .. Now i placed a url like http://stackoverflow.com/index.html it shows me blank , i tried many php scripts like http://attacker.com/omg.php and it doesn't runs the script on my domain ..

Now, Is there any Possibility of Attack vector here, If yes, kindly suggest me. And also is CORS or SOP Bypass possible here, I have CSP protection of the domain.

If i missed any info, you can ask me in comment. :)

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic that No Users shall be Upload any Image to the Profile picture just for Testing and instead of that i am showing Images like <div style="background-image: url("http://example.com/image.jpg")></div>

In this i have made a Input for user to place the path of jpg image from anysite he likes and i directly display the image from that site only, which is http://example.com/image.jpg in our case.

Now, i want to consider the Worst situation here, i haven't placed check nor whitelisted any Domains into the example.com/image.jpg .. Now i placed a url like http://stackoverflow.com/index.html it shows me blank , i tried many php scripts like http://attacker.com/omg.php and it doesn't runs the script on my domain ..

Now, Is there any Possibility of Attack vector here, If yes, kindly suggest me. And also is CORS or SOP Bypass possible here, I have CSP protection of the domain.

If i missed any info, you can ask me in comment. :)