1

I am testing an image uploader but I'm a mere developer. Here are the main points to consider:

  • There are no extension checks.
  • The image is uploaded to memory.
  • It is modified to be a certain size (50px x 50px).
  • It is saved to the database.
  • From testing, it seems if the image size failed, then on re-render the image displayed is simply broken
  • The app is asp.net and is on a Windows server.

With the exception of dodgy file name changing in Linux, is there a weakness? Can anything be executed if it's saved to the DB? I will suggest whitelisting extensions and content type, but is it necessary? If possible please provide a very basic (safe!) example of any major issues.

Improve this question
3
  • For PNG images, resizing doesn't always remove iTXt chunks, so if there are ways of embedding usable code in those, it will theoretically remain usable after resize. I know of ways to abuse this with PHP, but I'm not an ASP.NET expert, so don't know if there is a comparable way.
    – Matthew
    Commented Mar 9, 2016 at 8:53
  • do you sanitise? I cant tell if there would be an issue without seeing some code my friend! (I am a developer also! dont say mere :< )
    – TheHidden
    Commented Mar 9, 2016 at 9:44
  • always say mere! shift the blame! ha. I cant show code it's not my own. Sanitize what exactly?
    – user2330270
    Commented Mar 9, 2016 at 10:19

1 Answer 1

Reset to default
2

You can create an entirely new copy of the image, store that, and then discard the original.

Your path would become:

  • Upload image.
  • Crop to 50px x 50px.
  • Use ImageMagick or something similar to create an empty 50x50 image (in whatever standard format you want or with other controls added).
  • Copy the pixel data from the original to the new.
  • Save the new version.

If ImageMagick can't read the original, then perhaps there's something funny going on and it should be rejected anyway.

Improve this answer
3
  • This is a good answer because this approach strips all potential metadata from the uploaded image, which is where most image-file-based attacks originate. You could also combine the last four operations using ImageMagick's convert operator with the -strip and -resize 50x50 arguments, outputting to a new file.
    – John Deters
    Commented Mar 21, 2016 at 22:00
  • Is it better than converting to bit map and removing the meta data in your opinion(s)?
    – user2330270
    Commented Mar 22, 2016 at 14:20
  • The site only cares about the pixels. The site should accept as little as possible from the users. You can do all sorts of things with their (untrusted) image, or you can narrowly grab just the part you want and drop everything else. It's the same argument as black lists versus white lists. You can try to think of every possible place they could hide treachery in every possible image format, or you can just approve the 2500 pixels you actually want.
    – Omniwombat
    Commented Mar 22, 2016 at 19:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .