Currently the OneBox function of chat will convert any URL with a png, jpg, ... extension into an <img> element to give an inline image.

But there appears to be no validation that

  1. It is an image (and not something else, possible malicious1) with an image extension.
  2. It is a reasonable size.

1 would be a great way to exploit a browser vulnerability.

2 Answers 2


This is merely an arms race, and is no different to what you can do in SO:



Any validation we do could be bypassed by any half-respectable obnoxious oik. For example, by deliberately returning a valid image for an interval or to our IP.

  • Not if the server caches the image and sends it back the data it has already fetched.
    – Sam Becker
    Jul 16, 2010 at 13:21
  • Clearly malicious intent is one thing, but easy for anyone to accidentally link to a 10MB JPEG without thinking. The intent is that SE sites will not all be IT geeks.
    – Richard
    Jul 16, 2010 at 13:37
  • 1
    One thing we can -- and likely will -- do is limiting the ability to post images to users with a certain reputation. Images posted by other users will just be shown as a link to the image, making it everyone's own decision to click or not.
    – balpha StaffMod
    Jul 16, 2010 at 19:06

There are two sides to this argument.

  1. You can have the server validate everything, and then send the image data it downloaded to all of the connected peers. This however would take a lot of bandwidth, but it ensures that the images aren't malicious and no other trickery is taking place.

  2. You can let the clients download anything with an image file extension, ensuring that no trouble is had on the server side. This however isn't great as I demonstrated here because you can post a URL with a .jpg extension that has a redirect header (making the clients browser hit any URL that the attacker specifies) or contains lots and lots of data (forcing everyone to download a large file).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .