comment on

While you might be right that the OP is being overly cautious, saying that images files should not be dangerous is not quite correct. In the presence of bugs in the viewing software (which the OP cannot control), maliciously crafted images can be a security issue.

As a relatively paranoid individual, I follow the Security Now! podcast. I've been startled at the number of exploits based on errors in image processing programs reported in the past year.

During the Aug. 13, 2009 show, we heard about a buffer overflow in the ImageIO library that could result in either application termination or remote code execution. In the Sept. 3, 2009 show, there was discussion of a similar problem in libpng. Over the last year, it seems like there were at least a dozen of these kinds of exploits on one or another OS. (I think all of the majors were represented.)

That being said, I'm not sure that it's possible to perform a general test to find this kind of thing for an image upload site.

G. Wade

In reply to Re^4: security: making sure graphics uploaded by users are safe by gwadej
in thread security: making sure graphics uploaded by users are safe by keiusui

Are you posting in the right place? Check out Where do I post X? to know for sure.
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
Want more info? How to link or How to display code and escape characters are good places to start.


Don't ask to ask, just ask
	PerlMonks