Cross-site scripting from an Image

Question

I have a rich-text editor on my site that I'm trying to protect against XSS attacks. I think I have pretty much everything handled, but I'm still unsure about what to do with images. Right now I'm using the following regex to validate image URLs, which I'm assuming will block inline javascript XSS attacks:

"https?://[-A-Za-z0-9+&@#/%?=~_|!:,.;]+"

What I'm not sure of is how open this leaves me to XSS attacks from the remote image. Is linking to an external image a serious security threat?

The only thing I can think of is that the URL entered references a resource that returns "text/javascript" as its MIME type instead of some sort of image, and that javascript is then executed.

Is that possible? Is there any other security threat I should consider?

Answer 1

Another thing to worry about is that you can easily embed PHP code inside an image and upload that most of the time. The only thing an attack would then have to be able to do is find a way to include the image. (Only the PHP code will get executed, the rest is just echoed). Check the MIME-type won't help you with this because the attacker can easily just upload an image with the correct first few bytes, followed by arbitrary PHP code. (The same is somewhat true for HTML and Javascript code).

Answer 2

In that case, look at the context around it: do users only supply a URL? In that case it's fine to just validate the URLs semantics and MIME-type. If the user also gets to input tags of some sort you'll have to make sure that they are not manipulatable to do anything other then display images.

Answer 3

If the end-viewer is in a password protected area and you're using RESTful Urls, it's possible to request a Url on their behalf. Example:

src="http://yoursite.com/users/1234/delete"

or even if you're not using Restful Urls:

src="http://yoursite.com/pagethatdoessomething.xxx?vars=badvars"