Skip to main content
6 of 8
edited tags; edited title; added 89 characters in body

Allowing images from external sources opens doors to serious security exploits

Note: Please see Jeremy's answer for more info on how this poses a security risk.

I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can get all the analytical data you can about their question.

So a malicious user could theoretically post some posts and such with a small 1x1 image, which would allow him to get users IP addresses (thus general location/even workplace), exact times people visited his question, et cetera.

Maybe you don't care—such information isn't that revealing. However, some users might not feel the same.

(Suggested fix: only allow images from a list of image hosting sites you can vouch for.)

Aaron Yodaiken
  • 1.3k
  • 1
  • 8
  • 6