Timeline for Uploading images safe of XSS, php code and virus
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 20, 2013 at 1:53 | comment | added | Esteban | And the questions were if what I'm doing is enough or if I'm missing something. According those answers I'm doing almost everything, the only thing I was missing is the possible code in the Exif, but I already talked about that in Buherator's response. By the way, I'm sorry if I sound rude, that's not my intention, that's how I talk. | |
| Aug 20, 2013 at 1:47 | comment | added | Esteban | security.stackexchange.com/questions/32967/… an example of what I'm saying when I talk about include/require image files (the selected answer) and there are many threads where the answers talk about that or even the OP specifies he's using those functions for that (possible remote file inclusion because of that). When I say simple images I'm talking about only images, not pdf, docs or exe, only images (and only jpg, jpeg and png). About the old threads, yes, they're relevant, but maybe now exist a better solutions or worse attacks. | |
| Aug 19, 2013 at 19:46 | comment | added | AviD♦ | While there may indeed be new attacks, the stated answers there are still relevant, and have not gone out of date. Also as the answers explain, these apply to HTML image inclusion ( "<img src=..."), and for "simple" images (not sure what you mean by that). And, according to those answers: no, what you're doing is not enough. I am still not clear on what else you are asking, beyond those questions? | |
| Aug 19, 2013 at 13:45 | vote | accept | Esteban | ||
| Aug 19, 2013 at 13:36 | comment | added | Esteban | And about the duplicate, let's consider that those threads are 2 or 3 years old and there could be a lot of new attacks and/or defenses when talking about image uploads. I'm not asking "yeah, I heard about those attacks and want to know what should I do", I'm asking if what I'm doing is enough, since mine is a simple image upload supporting 3 formats, while others are using more complex stuff, like supporting all kind of images files (or even all kind of files), using the function Include or allowing huge files. | |
| Aug 19, 2013 at 13:27 | comment | added | Esteban | @AviD: I'm talking about the Fuction Include() of php. I said that because in almost all threads about this, they end up talking about "yeah, be careful using 'include' with images", and since I'm only using img src="" instead of any kind of include in my php script, I said that to avoid that kind of assumptions. | |
| Aug 19, 2013 at 8:38 | comment | added | AviD♦ | Also why is this not a duplicate of: security.stackexchange.com/q/600/33, security.stackexchange.com/q/235/33, security.stackexchange.com/q/10109/33, or security.stackexchange.com/q/14881/33? For example... | |
| Aug 19, 2013 at 8:31 | comment | added | AviD♦ |
What do you mean, The only thing I do with these images is show them with img src="" on my website, I never include images? What do you think "<img src=" does, if not include the image in the web page?
|
|
| S Aug 17, 2013 at 12:29 | history | suggested | Ali Ahmad | CC BY-SA 3.0 |
Formating and grammer
|
| Aug 17, 2013 at 12:05 | answer | added | buherator | timeline score: 4 | |
| Aug 17, 2013 at 11:45 | review | Suggested edits | |||
| S Aug 17, 2013 at 12:29 | |||||
| Aug 17, 2013 at 11:34 | review | First posts | |||
| Aug 17, 2013 at 11:45 | |||||
| Aug 17, 2013 at 11:18 | history | asked | Esteban | CC BY-SA 3.0 |