Search code examples
phpsecurityimagesrc

Src images and security


What about if I let users insert links to their own host's images, do I need to prevent any type of security issue?

To better exaplain, <img src="somedomain/somefile"/> in which case should make my site vulnerable?


Solution

  • One potential problem with allowing arbitrary image URLs is that the image's host could track all views and IP addresses. In a forum with little traffic that could put the image host in the position to identify specific users' IP addresses.

    Another is that you don't control what is shown in the image. An image resource could be dynamic and show pretty much anything at any given time to any user.

    Then there's the very remote risk of an image exploiting a vulnerability in a visitor's browser or image library. But those are exceedingly rare and likely to get patched quickly - I myself know of only one instance this has happened on a larger scale.

    Stack Overflow with is massive reach and traffic still allows external images - from that I tend to deduce that the risks are somewhat manageable.

    Still, if you want to make really sure, you're best off fetching the image resource, copying it using an image library (to make sure it's a real image and to strip any sensitive metadata), and storing it on your server.