2 deleted 114 characters in body
source | link

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image.

What I'm currently doing is file_get_contents('pic') (or curl) the url and checking for httpcode and content-type, resulting in a 404 or whatever other code if content-type differs from 'image/jpeg', 'image/png', 'image/gif' (these are the only mime types i'm allowing), otherwise a 200 or 304.

But I've read a lot of posts saying that a picture might contain malicious code, maybe in their exif header. Now, I'm not using include() to show pictures and always do a mywebsite.com/safepic?url='.urlencode('external_picture_url') in php or 'mywebsite.com/safepic?url='+encodeURIComponent('external_picture_url') in javascript.

So, if the content type returned from curl matches that of a valid picture, I run a getimagesize(), but I'm sure this is not enough, I also force the content type to be image\something but don't think this make sure the file is 'executed' as a picture and prevent the malicious code bytes to be recognized. I also thought about doing all these checks and a lot more (like trying to resizing to check if it is really a picture, and creating a whole new picture through imagecreatefromjpeg based from that one).

Got any ideas ?

EDIT, but i'mi removed the part where i said i was concerned about license when saving external pictures, as users don't really care about these stuff - though I mightsomebody didn't understand i was just delete pictures when the copyright owner requests it -doing a self consideration and not allowed pictures (soft porn, illegal porn, etc if you know what i mean), - althoughasking a question. I can still just delete the content as soon as i find it or whenremoved it is reported and permanentely ban the userbefore getting downvotes.

Got any ideas ?

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image.

What I'm currently doing is file_get_contents('pic') (or curl) the url and checking for httpcode and content-type, resulting in a 404 or whatever other code if content-type differs from 'image/jpeg', 'image/png', 'image/gif' (these are the only mime types i'm allowing), otherwise a 200 or 304.

But I've read a lot of posts saying that a picture might contain malicious code, maybe in their exif header. Now, I'm not using include() to show pictures and always do a mywebsite.com/safepic?url='.urlencode('external_picture_url') in php or 'mywebsite.com/safepic?url='+encodeURIComponent('external_picture_url') in javascript.

So, if the content type returned from curl matches that of a valid picture, I run a getimagesize(), but I'm sure this is not enough, I also force the content type to be image\something but don't think this make sure the file is 'executed' as a picture and prevent the malicious code bytes to be recognized. I thought about doing all these checks and a lot more (like trying to resizing to check if it is really a picture, and creating a whole new picture through imagecreatefromjpeg based from that one), but i'm concerned about license, as users don't really care about these stuff - though I might just delete pictures when the copyright owner requests it - and not allowed pictures (soft porn, illegal porn, etc if you know what i mean), - although I can still just delete the content as soon as i find it or when it is reported and permanentely ban the user.

Got any ideas ?

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image.

What I'm currently doing is file_get_contents('pic') (or curl) the url and checking for httpcode and content-type, resulting in a 404 or whatever other code if content-type differs from 'image/jpeg', 'image/png', 'image/gif' (these are the only mime types i'm allowing), otherwise a 200 or 304.

But I've read a lot of posts saying that a picture might contain malicious code, maybe in their exif header. Now, I'm not using include() to show pictures and always do a mywebsite.com/safepic?url='.urlencode('external_picture_url') in php or 'mywebsite.com/safepic?url='+encodeURIComponent('external_picture_url') in javascript.

So, if the content type returned from curl matches that of a valid picture, I run a getimagesize(), but I'm sure this is not enough, I also force the content type to be image\something but don't think this make sure the file is 'executed' as a picture and prevent the malicious code bytes to be recognized. I also thought about doing all these checks and a lot more (like trying to resizing to check if it is really a picture, and creating a whole new picture through imagecreatefromjpeg based from that one).

Got any ideas ?

EDIT, i removed the part where i said i was concerned about license when saving external pictures, as somebody didn't understand i was just doing a self consideration and not asking a question. I removed it before getting downvotes.

    Tweeted twitter.com/#!/StackSecurity/status/509490356195307520
1
source | link

How to safely display external pictures?

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image.

What I'm currently doing is file_get_contents('pic') (or curl) the url and checking for httpcode and content-type, resulting in a 404 or whatever other code if content-type differs from 'image/jpeg', 'image/png', 'image/gif' (these are the only mime types i'm allowing), otherwise a 200 or 304.

But I've read a lot of posts saying that a picture might contain malicious code, maybe in their exif header. Now, I'm not using include() to show pictures and always do a mywebsite.com/safepic?url='.urlencode('external_picture_url') in php or 'mywebsite.com/safepic?url='+encodeURIComponent('external_picture_url') in javascript.

So, if the content type returned from curl matches that of a valid picture, I run a getimagesize(), but I'm sure this is not enough, I also force the content type to be image\something but don't think this make sure the file is 'executed' as a picture and prevent the malicious code bytes to be recognized. I thought about doing all these checks and a lot more (like trying to resizing to check if it is really a picture, and creating a whole new picture through imagecreatefromjpeg based from that one), but i'm concerned about license, as users don't really care about these stuff - though I might just delete pictures when the copyright owner requests it - and not allowed pictures (soft porn, illegal porn, etc if you know what i mean), - although I can still just delete the content as soon as i find it or when it is reported and permanentely ban the user.

Got any ideas ?