6

In my Wordpress blog (though this may be true of other blogs too), there is a preview web page feature.

So when I get a comment with a link, I can hover over the link, and it shows me a preview of the page. I sometimes use this to check possible spam messages.

But is there any risk in this? For example, if the webpage has a script or XSS based attack, can my blog be compromised?

To make it clear, I'm not talking about any plugin. In Wordpress comments section, people can optionally post a link to their website. If you hover your mouse over the link, it generates a preview of the website. That's what I was talking about. This seems to be an inbuilt feature of Wordpress.

1 Answer 1

3

In the following, I suppose that you are talking about the ShrinkTheWeb plugin for Wordpress. This plugin work with the server maintained by the ShrinkTheWeb people: when a "hover" is done over the link, a request is sent to your server, which will then forward the request to the ShrinkTheWeb server; the latter will actually try to access to target Web site, compute a thumbnail, and send it back to your server as a picture. For your server, there is only a picture, and that's what is sent back to the user's browser.

Any plugin can have its own security issues, but I would say that in this case, the risks are on the ShrinkTheWeb server's side, because it is that server who will do the actual access to the possibly nasty Web site at the end of the user provided link. Your risks are more along the following lines:

  • If the ShrinkTheWeb server is hijacked, it might be possible that it begins to return malicious data instead of thumbnails of Web sites as innocuous pictures; depending on how poorly the WordPress plugin is written (I have not checked), this may or may not be dangerous for your server or even the user's browser. However, as long as the ShrinkTheWeb server holds the line, it will return only well-formed pictures, which will be harmless for your server and the user's browser.

  • The screenshots will somehow appear to be "in your blog site" so you might have public relations issues if "unwanted" pictures appear that way. But that's a matter of tracking and deleting spams and trolls; nothing really new here.

1
  • No, I wasn't talking about the plugin. I will update my question to make it clearer.
    – Shantnu
    Commented Aug 9, 2013 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .