Home/ Questions/Q 8649951
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T13:41:28+00:00

Imagine an environment in which users can upload images to a website by either

  • 0

Imagine an environment in which users can upload images to a website by either uploading it from their pc or referring to a remote url.

As part of some security checks I’d like to make sure that the referenced object is indeed an image.

In the case of a remote-url, I of course check the content-type, but this isn’t bullet-proof.

I figured I could use ImageMagick to do the task. Perhaps executing the ImageMagick.identify() method and if no error is returned and returned type is either JPG|GIF|,etc. the content is an image. (In a quick check I noticed that TXT files are identified correctly as well, so I have to blacklist these)

Is there any better way in doing this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You could probably simply load the image via ImageMagick’s appropriate function for your language of choice. If the image isn’t formatted properly (in terms of internal formatting, not its aesthetic properties, that is), I would expect ImageMagick to refuse to load it and report an error. In PHP, for example, readImage returns false if the image fails to load.

    Alternatively, you could read the first few hundred bytes of the file and determine if the expected image file format headers are present; e.g., “GIF89” etc.

    • 0