It is known that in modern browsers you can't run XSS in img src(assuming quotes are escaped), because neither javascript: protocol, nor svg will execute the code. But does it mean that trusted data with filtered quotes is unable to cause any damage, or are there any other possible vulnerabilities?

I want to underline that I mean vulnerabilities aside from XSS.


1 Answer 1


The risk is pretty low, assuming some basic cautions. One threat would be to have an image that is much larger than intended and basically overlays the page with some sort of phishing content. That's easily avoided by limiting the image size, though. Another would be to use a "watering hole" attack, in the event that a vulnerability in an image parser is discovered; if your site is popular, attackers might post links to their malicious exploit image on your site to try to catch lots of victims. Finally, there's reputational risk; if somebody wants to post shock images, racist symbology, cartoons of the prophet Muhammad, or pornography on your site (and especially if there's any risk of it being less than 100% clear who is responsible for the image), some people will be driven away from your site and others will take it as incentive to vigilante action against you. There's also decompression bombs, which are small files in compressed formats that grow to extreme size when decompressed and can cause denial-of-service for users; some image formats present some risk from these, and your users won't appreciate it if your site crashes their browser.

To be clear, these issues in general are the kinds of things you run into when trying to allow users to show images; they aren't unique to allowing users to specify the <img src=" value.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .