Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

Currently the OneBox function of chat will convert any URL with a png, jpg, ... extension into an <img> element to give an inline image.

But there appears to be no validation that

  1. It is an image (and not something else, possible malicious1) with an image extension.
  2. It is a reasonable size.

1 would be a great way to exploit a browser vulnerability.

share|improve this question

This is merely an arms race, and is no different to what you can do in SO:



Any validation we do could be bypassed by any half-respectable obnoxious oik. For example, by deliberately returning a valid image for an interval or to our IP.

share|improve this answer
Not if the server caches the image and sends it back the data it has already fetched. – Sam152 Jul 16 '10 at 13:21
Clearly malicious intent is one thing, but easy for anyone to accidentally link to a 10MB JPEG without thinking. The intent is that SE sites will not all be IT geeks. – Richard Jul 16 '10 at 13:37
One thing we can -- and likely will -- do is limiting the ability to post images to users with a certain reputation. Images posted by other users will just be shown as a link to the image, making it everyone's own decision to click or not. – balpha Jul 16 '10 at 19:06

There are two sides to this argument.

  1. You can have the server validate everything, and then send the image data it downloaded to all of the connected peers. This however would take a lot of bandwidth, but it ensures that the images aren't malicious and no other trickery is taking place.

  2. You can let the clients download anything with an image file extension, ensuring that no trouble is had on the server side. This however isn't great as I demonstrated here because you can post a URL with a .jpg extension that has a redirect header (making the clients browser hit any URL that the attacker specifies) or contains lots and lots of data (forcing everyone to download a large file).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .