Question

Let’s say I allow users to link to any images they like. The link would be checked for syntactical correctness, escaping etc., and then inserted in an <img src="..."/> tag.

Are there any known security vulnerabilities, e.g. by someone linking to “evil.example.com/evil.jpg”, and evil.jpg contains some code that will be executed due to a browser bug or something like that?

_{(Let’s ignore CSRF attacks – it must suffice that I will only allow URLs with typical image file suffixes.)}

Answer 1

Security risks in image files crop up from time to time. Here’s an example: https://web.archive.org/web/1/http://articles.techrepublic%2ecom%2ecom/5100-22_11-5388621.html?tag=nl.e019. It’s an old article, so obviously these things have been rolling around for a while.

While it’s impossible to say for sure that something is always safe/never safe, so far it sounds like the risks have been relatively low, and are patched by the image viewer manufacturers pretty quickly. IMO the best test is how often you hear about actual problems occurring. This threat vector has been a known possibility for years, but hasn’t really become widespread. Given the extent to which people link images in public forums, I’d expect it to become a big problem pretty quickly, if it was a realistic sort of attack.