I am building a web application where a user can update his avatar by uploading a picture from his computer file directory. Here's how I implemented it:

<input id="profile_pic" class="avatar-upload" type="file">

However, I have noticed that if a user changes type="file" to type="url", he will be able to upload a picture using any URL.
So is it a safe option or should I prohibit users to act so? How can this be exploited?

  • 3
    It is unknown what you are exactly doing with the user provided value so no real exploit can be given. But if you include is as img tag CSRF might be possible and if you fail to sanitize the URL XSS too. And maybe other things, depending on how you use the value. – Steffen Ullrich Apr 14 '16 at 19:32

Assuming the user is submitting a URL that is then stored on the server and put into the image link:

Its generally good practice for web sites to not give up personal info about their users (including IP addresses) which, if you put a URL to a server you control with an avatar that will only be used by that one site, an attacker could use to build a list of all the users' IP addresses and probably even cross reference it with when they are posting or show up as "online" to narrow down who is which IP. While it is still possible to gather this (i.e. by posting a link to the same, that entices users to click on it) having it done automatically is bad form. Users can't avoid giving away their IP to any other user when visiting the page. I would strongly advise against this as a "feature".

  • Just retrieve and store the image once from the URL then supply it forevermore from the app. – Dave Apr 14 '16 at 23:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.