Welcome Guest, Not a member yet? Register   Sign In
image Upload
#1

Goodday everyone

I would like my user to upload images (avatar, and other photos to thiere private album)
the image name will be stored in mysql db

My big problem is im not sure about security on image upload
i have heard about php code in image headers and so on

what is a safe way to insure security on my site .

ps; all images will be resized to 4 thumbnail sizes (used in different parts of the site)

can some one stear me in the right direction or give me some sample code id really apreciate it

thanks
Reply
#2

Resave image using an image processing library (GD/Imagick). I believe those strip out the metadata, or you can manually remove it using an EXIF library. Your thumbnail images you are creating are already doing this. You can test by creating a comment in the metadata for an image and try resaving it using the library to check if the metadata was copied over.

Its also helpful to use a CDN to store the images where the CDN is using a webserver using a different language than what you are using. For instance, if you are using PHP for your website, and the CDN storing the images is using .NET or something, you can't execute PHP code on a .NET server so it's rendered ineffective.
Reply
#3

http://www.codeigniter.com/user_guide/li...urity.html

An optional second parameter, is_image, allows this function to be used to test images for potential XSS attacks, useful for file upload security. When this second parameter is set to TRUE, instead of returning an altered string, the function returns TRUE if the image is safe, and FALSE if it contained potentially malicious information that a browser may attempt to execute.

if ($this->security->xss_clean($file, TRUE) === FALSE)
{
// file failed the XSS test
}
Reply
#4

(First post!)

Generally there are 2 important parts you need to consider when creating a file upload function for your application.

1: Check file extensions properly and white list the ones you want to allow. As in "allow jpeg, anything else is not allowed".
The reason for this is that checking if the file is a "correct" image and/or removing EXIF data and so on wont do it since it can usually be bypassed by hiding code inside the data part of the image. See https://truesecdev.wordpress.com/2015/03...llyshelly/

The most optimal solution would simply be to store the image without any extension at all. This way you can have a handler that simply reads the data from the file and returns it either as image data to the browser or as base64 to be used with https://en.wikipedia.org/wiki/Data_URI_scheme

2: Store the data outside of the web root and have a handler that accesses it. If an attacker can't access the file directly it will make it harder to make use of it.

3-x: There are more ways to make it even more secure, like storing the data in a place where execution is not possible and so on. But I consider the 2 points above to be the most important ones.
Reply




Theme © iAndrew 2016 - Forum software by © MyBB