Is it safe to allow linking to images by URL in user-made posts?

Question

I'm working on an imageboard website that uses the TinyIB bulletin board software. When editing the settings, I found this line:

define('TINYIB_UPLOADVIAURL', false); // Allow files to be uploaded via URL

If I edit this to be true, would that be just as safe? Or should I stick to only allowing direct uploads?

Answer 1

It is harder to tell for sure whether the image embedding is safely implemented in TinyIB, but this setting affects the $embeds_enabled in inc/html.php:270, suggesting this relates to embedding rather than uploading, which sounds more like downloading the file from the URL on server side.

With embedding, the image is downloaded directly from an untrusted third party. The security issues involved with this include:

• Different files could be offered to different viewers. This makes the job of moderators harder, because what they see may not be what someone else sees.
• The external source could give harmful content that is, e.g., crafted to exploit a vulnerability in the browser. Likewise, this could only be available for downloads from certain user-agents, making it hard to detect.
• It leaks data to a third party: the third party gets logs from the visit. It is impossible to know whether such data is collected and how it is used. (Likely, you would not be able to comply with GDPR without knowing where the PII goes.)
• The data may change or decease at any point. That could leave broken images to your site or activate any of the other threats. In the long run this is not even limited to the current administrator of the third party domain, but an expired domain could later be bought for malicious purposes.

For these reasons, image embedding on all Stack Exchange sites is only available using file uploads to a trusted third party, Imgur. You might want to take the same approach.