How does StackOverflow handle images from external URLs?

Question

When you ask a question on SO, you can add images. One of the options for adding images is to add them based on a URL. SO wouldn't be able to just accept any URL for an image, however.

For instance, if someone created a site that required basic http authentication in order to serve up the image, then they used that image's URL in their SO question, everyone who navigated to that question in their browser would be presented with a username/password dialog, presenting a security risk to SO users.

That being said, I'm curious as to how SO handles URL-based images in questions. The site must proxy these images somehow, right?

EDIT

To help clarify, let's say a hacker sets up a little server which requires basic authentication. Then, when creating a question, or posting an answer, he adds an image from a URL, and for the image URL he enters a URL that points to his little server, such as: "http://myhackingserver.com/someimage.jpg". In this scenario, if the site just rendered <img src="http://myhackingserver.com/someimage.jpg" /> onto the page, any user viewing the page would be presented with a username/password dialog. It's a phishing-style attack.

Answer 1

You can test it here.

That was just as easy as a simple php script:

<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="Stack Overflow"');
    header('HTTP/1.0 401 Unauthorized');
    header("Content-type: image/jpg");
       echo file_get_contents("hacked.jpg");   
    exit;
} else {
    header("Content-type: image/gif");
       echo file_get_contents("block.gif");    
}
?>

An image of a box should show up if you fake logged-in otherwise it states that you were hacked.

---

It seems that the SE just takes the images as they are, no matter how much they can damage the page.

Answer 2

If you add the image using the toolbar on the top of the text area to enter a post's text, the image is copied from the server to the server used for images on Stack Exchange sites. Supposing that it works in the case you are describing, the user who is adding the image is asked for the credentials, and then the image is uploaded in the server normally used for images.

If you are adding the image through the <img> tag, then you just write the URL as you would normally do, considering that the default values for the attributes are the following ones:

• src=""
• width="" (up to 999)
• height="" (up to 999)
• alt=""
• title=""

In this case, there isn't any proxy that Stack Exchange uses; the URL you use is used as it is.

Answer 3

If you view the page source it's just an <img> tag, which doesn't allow for the display of arbitrary HTML. If your browser did that then you would blame the browser, not the website. Am I missing something here?