Is it safe to use a PHP script to load a Base64-encoded PNG?

Question

As part of a bigger project that I am working on, I need to write a PHP script to convert a Base64 string into an image. The way I would like to go about passing the Base64 string into the script via a GET query, so...

example.com/base64ToPng.php?base64=thisIsTheBase64ForTheImage

I would then like to convert the Base64 that is passed in to a PNG image and display it as if the PHP file itself were an image. While this is not an issue from a development standpoint, I am concerned about the safety of doing this. Would I put myself in any danger since the Base64 is going to be created by the user? (Or more accurately, the Base64 is going to be created by a program based on the image the user provided it.) I am particularly worried about the user crafting a malicious image that could execute arbitrary code, but I do not know if this is a valid concern given that the image is only going to be recreated by the PHP script but not stored on the server.

<?php       
    if(!isset($_GET['x'])) {
        die();
    }

    $image = base64_decode($_GET['x']);
    header ('Content-type: image/png');
    imagepng($image, NULL, 0);
?>

Answer 1

It isn't safe to use URLs longer than about 2000 characters. While the URL RFC doesn't specify any particular limit, most browsers limits the number of characters in a URL to less than 2000 characters.

Another problem is that using base64 is very space inefficient, as you'll be encoding three bytes with four bytes. This means that the maximum size of image you can practically attach reliably o most browsers is less than 1.5 KB.

You also have to consider that running this service will make your webserver log files fill up really quickly, as it'll be logging the entire URLs. It may be possible to truncate/hash the logged URL, but that'll make troubleshooting issues more difficult.

Appendix:

Unless you want to actually edit the image data, your implementation can just echo the image data, no need for imagepng():

<?php
if(!isset($_GET['x'])) {
    die();
}
$image = base64_decode($_GET['x']);
header ('Content-type: image/png');
echo $image;
?>

Answer 2

That said, do I still need to worry about code execution vulnerabilities if I use the method you suggested here?

No, you don't. base64_decode still returns a string, which cannot get executed at the point of decoding. This way, that you just echo the string, it will not execute any PHP.

On the client side: Injecting JavaScript could be triggered however, but as you set the image/png header, this is already prevented.