Ok, here is a scenario for you here.
You have a database. You have a table in it that you will store small 30x30 pixel PNG images. They are base64 encoded. They will be echoed out as an avatar for the profile.
I have seen tricks in the past with XSS that use image tags to retrieve javascript code.
<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
Can this be done with a base64 encoded image? Is an attacker capable of crafting something that can introduce this sort of risk? If so, what can I do to mitigate the threat?
src="imgs.mysite.com?id=123"
where 123 is the id of the image in your database. Is this the scenario you mean to ask? – Andrew Hoffman Mar 17 '15 at 3:33<script src="//example.com/imagegenerator?with=datainterpretedascode">
? – Bergi Mar 17 '15 at 11:52