What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

When you ask a question on SO, you can add images. One of the options for adding images is to add them based on a URL. SO wouldn't be able to just accept any URL for an image, however.

For instance, if someone created a site that required basic http authentication in order to serve up the image, then they used that image's URL in their SO question, everyone who navigated to that question in their browser would be presented with a username/password dialog, presenting a security risk to SO users.

That being said, I'm curious as to how SO handles URL-based images in questions. The site must proxy these images somehow, right?

EDIT

To help clarify, let's say a hacker sets up a little server which requires basic authentication. Then, when creating a question, or posting an answer, he adds an image from a URL, and for the image URL he enters a URL that points to his little server, such as: "http://myhackingserver.com/someimage.jpg". In this scenario, if the site just rendered <img src="http://myhackingserver.com/someimage.jpg" /> onto the page, any user viewing the page would be presented with a username/password dialog. It's a phishing-style attack.

share|improve this question
1  
A username/password dialog would be annoying, but how would it be a security risk to the person browsing? –  David Z Dec 7 '11 at 18:10
9  
The dialog would appear as if it's a dialog generated by SO. It might trick users into entering their username/password. At that point, the hacker could gather up username/password combinations. –  Brandon Montgomery Dec 7 '11 at 18:17
1  
OK, I see, although I would think modern browsers should identify the source of the dialog in some way. As I recall in Firefox it starts out by saying "The page at http://whatever... wants to know" which would indicate that it's not Stack Overflow asking for the password. (And yes, I know people don't read things, but you can't entirely blame the site or the browser for that) Besides, I'm not even sure that browsers will put up the authentication dialog for images; they may just fail to display. –  David Z Dec 7 '11 at 18:34
    
No dialog appears in Chrome when I embed an image requiring HTTP authentication. I remember this being an issue in the past, but maybe some browsers have fixed it. I agree that Stack Overflow mirroring all embedded images might be a good idea. –  Jeremy Banks Dec 7 '11 at 18:34
    
@BrandonMontgomery see my answer. –  amanaP lanaC A nalP A naM A Dec 7 '11 at 18:53
    
FF and IE both present the user with the auth dialog on this question now. –  Brandon Montgomery Dec 7 '11 at 19:20
    
@BrandonMontgomery due to the script in my answer.... :-P –  amanaP lanaC A nalP A naM A Dec 7 '11 at 19:44
2  
Related: Images in posts are a privacy threat –  Jeremy Banks Dec 7 '11 at 20:22
add comment

3 Answers

You can test it here.

That was just as easy as a simple php script:

<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="Stack Overflow"');
    header('HTTP/1.0 401 Unauthorized');
    header("Content-type: image/jpg");
       echo file_get_contents("hacked.jpg");   
    exit;
} else {
    header("Content-type: image/gif");
       echo file_get_contents("block.gif");    
}
?>

An image of a box should show up if you fake logged-in otherwise it states that you were hacked.


It seems that the SE just takes the images as they are, no matter how much they can damage the page.

share|improve this answer
    
...except on Chrome, which apparently just doesn't show the dialog. –  Brandon Montgomery Dec 7 '11 at 19:40
    
@BrandonMontgomery I saw the dialog in Chrome. What image do you see? –  amanaP lanaC A nalP A naM A Dec 7 '11 at 19:42
3  
I don't get a dialog on Chrome; I do get one on FF. But it says A username and password are being requested by http://www.blipit.net. –  NullUserException อ_อ Dec 7 '11 at 19:57
1  
@ProblematicTitleException I know that. and if you click cancel you see a different image than if you click ok. Also it is very easy to add some backend to take the info that people enter in. (people sometimes don't even pay attention that the dialog is not from the page they are on) –  amanaP lanaC A nalP A naM A Dec 7 '11 at 20:10
    
@AMan - I get one on Chrome if I open it in a new tab; it's a dropdown dialog. Clicking "Cancel" produces "You have been hacked". Entering (fake) credentials results in a cube. –  Kevin Vermeer Dec 7 '11 at 20:10
    
@KevinVermeer yep. odd that it shows up in some browsers and not others (I dont know what you mean by a dropdown) –  amanaP lanaC A nalP A naM A Dec 7 '11 at 20:11
    
I get a http auth dialog and a redirection on Chrome 87 (or whatever the latest stable version is.) Ugh, good work! –  Pëkka Dec 7 '11 at 20:35
    
Well I am on dev Chrome (17.0.963.0) and I see the dialog –  amanaP lanaC A nalP A naM A Dec 7 '11 at 20:36
    
@Aman - i.stack.imgur.com/s6ozS.png –  Kevin Vermeer Dec 7 '11 at 20:39
    
@KevinVermeer thats ur browser :-P its different on every browser –  amanaP lanaC A nalP A naM A Dec 7 '11 at 20:48
    
@Shog9 the edit is not as beautiful as seeing it happen on this page, but I'll take it for now :-D –  amanaP lanaC A nalP A naM A Dec 7 '11 at 20:50
    
It's waaaay less annoying though, @Amana... And it's also what would almost certainly happen in short order if you actually tried this on the main site (similar things have been done before). –  Shog9 Dec 7 '11 at 20:52
    
@Shog9 yea I remember something like this happening earlier on this year, I just can't remember when. –  amanaP lanaC A nalP A naM A Dec 7 '11 at 20:53
add comment

If you add the image using the toolbar on the top of the text area to enter a post's text, the image is copied from the server to the server used for images on Stack Exchange sites. Supposing that it works in the case you are describing, the user who is adding the image is asked for the credentials, and then the image is uploaded in the server normally used for images.

If you are adding the image through the <img> tag, then you just write the URL as you would normally do, considering that the default values for the attributes are the following ones:

  • src=""
  • width="" (up to 999)
  • height="" (up to 999)
  • alt=""
  • title=""

In this case, there isn't any proxy that Stack Exchange uses; the URL you use is used as it is.

share|improve this answer
    
You don't need an <img> tag; a regular markdown image works just as well. –  balpha Dec 8 '11 at 9:33
add comment

If you view the page source it's just an <img> tag, which doesn't allow for the display of arbitrary HTML. If your browser did that then you would blame the browser, not the website. Am I missing something here?

share|improve this answer
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .