i want to write (and currently writing) a php script to display external images,

Question

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image.

What I'm currently doing is file_get_contents('pic') (or curl) the url and checking for httpcode and content-type, resulting in a 404 or whatever other code if content-type differs from 'image/jpeg', 'image/png', 'image/gif' (these are the only mime types i'm allowing), otherwise a 200 or 304.

But I've read a lot of posts saying that a picture might contain malicious code, maybe in their exif header. Now, I'm not using include() to show pictures and always do a mywebsite.com/safepic?url='.urlencode('external_picture_url') in php or 'mywebsite.com/safepic?url='+encodeURIComponent('external_picture_url') in javascript.

So, if the content type returned from curl matches that of a valid picture, I run a getimagesize(), but I'm sure this is not enough, I also force the content type to be imagesomething but don't think this make sure the file is 'executed' as a picture and prevent the malicious code bytes to be recognized. I also thought about doing all these checks and a lot more (like trying to resizing to check if it is really a picture, and creating a whole new picture through imagecreatefromjpeg based from that one).

Got any ideas ?

Explanation / Answer

I think you are overthinking the problem.

You should be worried if your clients were able to upload pictures. In that case, the client could fake the MIME type, create malicious content on EXIF headers, put garbage inside the picture, and exploit it by using a Local File Include on your server.

But looks like this is not the case. If your script will just show the pictures, why not hotlinking to the image? Let the client browser download and show it.

If you don't want to hotlink the picture, you could just download and send them using curl.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.