Externally linked images - How to prevent cross site scripting

Question

On my site, I want to allow users to add reference to images which are hosted anywhere on the internet. These images can then be seen by all users of my site. As far as I understand, this could open the risk of cross site scripting, as in the following scenario: User A adds a link to a gif which he hosts on his own webserver. This webserver is configured in such a way, that it returns javascript instead of the image. User B opens the page containg the image. Instead of seeing the image, javascript is executed.

My current security messures are currently such, that both on save and open, all content is encoded. I am using asp.net(c#) on the server and a lot of jquery on the client to build ui elements, including the generation of image tags.

Is this fear of mine correct? Am I missing any other important security loopholes here? And most important of all, how do I prevent this attack? The only secure way I can think of right now, is to webrequest the image url on the server and check if it contains anything else than binary data...

Answer 1

Checking the file is indeed an image won't help. An attacker could return one thing when the server requests and another when a potential victim makes the same request.

Having said that, as long as you restrict the URL to only ever be printed inside the src attribute of an img tag, then you have a CSRF flaw, but not an XSS one.

Someone could for instance create an "image" URL along the lines of: http://yoursite.com/admin/?action=create_user&un=bob&pw=alice Or, more realistically but more annoyingly; http://yoursite.com/logout/

If all sensitive actions (logging out, editing profiles, creating posts, changing language/theme) have tokens, then an attack vector like this wouldn't give the user any benefit.

But going back to your question; unless there's some current browser bug I can't think of you won't have XSS. Oh, remember to ensure their image URL doesn't include odd characters. ie: an image URL of "><script>alert(1)</script><!-- may obviously have bad effects. I presumed you know to escape that.