I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic that No Users shall be Upload any Image to the Profile picture just for Testing and instead of that i am showing Images like
<div style="background-image: url("http://example.com/image.jpg")></div>
In this i have made a Input for user to place the path of jpg image from any site he likes and I directly display the image from that site only, which is
http://example.com/image.jpg in our case.
I want to consider the worst situation here, I haven't placed check nor whitelisted any domains into the
example.com/image.jpg. I placed a URL like
http://stackoverflow.com/index.html it shows me blank, I tried many PHP scripts like
http://attacker.com/omg.php and it doesn't run the script on my domain.
Is there any possibility of attack vector here? If yes, kindly suggest me. And also is CORS or SOP Bypass possible here, I have CSP protection of the domain.
Note: In the URL Section, i am making First validating check at
scheme of URL where http:// , // and https:// are WhiteListed & in the Image section i have ONLY whitelisted Numbers + Alphabets and special characters like
/ .Rest else are blocked