2

I know it’s not safe to allow arbitrary images in comments without proxying.

I just saw this feature. It seems that all current user agents which implement it disable scripting and external resource loading (but still allowing arbitrary XHTML and CSS). So for the all current web browsers versions, it is not a security risk at all.

So are there some older web browsers versions which allowed running JavaScript from an SVG loaded with this?
It seems this were never true for Opera and Firefox. However, I couldn’t find how to downgrade Internet Explorer and I couldn’t find older versions of Google Chrome either.

  • Note this question is only for client side. – user2284570 Sep 8 '15 at 19:45
  • I think your question is getting lost, and the title doesn't seem to match the body. – schroeder Sep 8 '15 at 22:37
  • @schroeder If the title would fully match the body, then this question would be a full external ressource question. My point is if it is completely safe to don't filter the image format. And being able to run script for an svg image is the only reason I see to do so. except if that xss way were never implemted, which is the point of my question's body. – user2284570 Sep 8 '15 at 22:53
  • 1
    Note: I've removed an image that might potentially induce seizures. Thanks to Giacomo Alzetta for reporting it. I am not certain how to handle this and posted this meta question. To me, it would seem best to find another demo if a demo is needed at all. – Luc Jul 19 at 11:06
1

As long as your server and client are up to date, codes, standards, and framework safety: Yes...

If they're older: No!

Just to be safe: !!!NO!!!

There were a few old bugs that caused issues with this sort of thing on both ends, so we'll approach them both that separately.

Server Side Issues:

Probably not what you're asking for, but I wanted to make sure this gets addressed as well.

In the olden days of flat file servers with upload areas, and some other server side protocols/programs this introduced one very large problem. That problem was the dreaded script injection. By uploading this malformed image they were actually uploading a script that they could then access, and use to gain control of the server, and subsequently a vector of attack against clients as well.

Newer frameworks however have protection for this built in, and if your server programmer is worth anything then they should know about these types of attacks and how to guard against them. This is still a problem even to this day in bad roll your own servers some people keep doing. These programmers may be smart programmers, but sometimes this just falls through the cracks.

On the client side:

For their safety and security, no. It is NEVER okay to allow arbitrary formats for anything. In fact it is never okay to allow a user to do anything arbitrary at all. There is a reason for this, and it is considered a security best policy:

Assume ALL content you personally have not produced to be dangerous

Because of that reason, you should never allow it. Why? Because just like the content being somewhat out of control, client browser versions are completely outside your control. This means that a well meaning person could connect to the place the image is, and get hijacked. Someone would be using your code, website, and functionality to ruin another persons life. You don't want that to happen.

The tentative Yes...:

This isn't such an issue as long as the web/server developer is willing to put in the time, effort, and functionality to safe guard against these attacks and can guarantee that they and their clients are safe from these code injections. That's a lot of work though, so it's a lot easier(not to mention safer for everybody) to just say no.

(you can't tell but the ellipses is italic too...)

  • Above all because I finally found a research paper describing how to run JavaScript with xslt in an ꜱᴠɢ used with an img tag with firefox. I was feeling to lazy for writing it here. The server case won’t apply because the purpose is to allow every image type, not every content. I’m just checking the mime type start withimage/. I also make sure that browser won’t use a different one that the one specified when uploading. – user2284570 Oct 14 '15 at 19:05
  • Sure, if I would update the image of this question with the example of the research paper, I would be able to hijack sessions of peoples who read that page, but I’m feeling to lazy for doing it. – user2284570 Oct 14 '15 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.