5 ms·
...this is probably a hint: 00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c |......JFIF.....,| 00000010 01 2c 00 00 ff fe 03 72 3c 68 74 6d 6c 3
by d33 10y ago
...this is probably a hint:
00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c |......JFIF.....,|
00000010 01 2c 00 00 ff fe 03 72 3c 68 74 6d 6c 3e 3c 62 |.,.....r<html><b|
$ file index.html
index.html: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: "<html><body><style>body { visibility: hidden; } .n { visibilit", baseline, precision 8, 1000x667, frames 3
I wonder what are the security implications of that.
- deathanatos 10y ago> I wonder what are the security implications of that. At least any terminal escape sequence can be executed if you run `file` on a JPEG, it seems, since this: curl -s 'http://www.imagemagick.org/image/fuzzy-magick.png' | convert - -set comment "$(printf 'asdf\x1b[1;31mTest?\x1b[0m hmm')" test2.jpg file test2.jpg Results in red text on my terminal for me. (It also results in file writing a 0xff 0xdb to the terminal, which the terminal turns into the unicode fallback character since it's not valid text…)
- michaelmior 10y agoI just get the following so it seems like my version of file has been patched to handle this case. test2.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, comment: "asdf\033[1;31mTest?\033[0m hmm", baseline, precision 8, 320x85, frames 3
- throwanem 10y agoSame here with file(1) version 5.22 from the Debian jessie package repo. I'd be interested to know in which versions this kind of thing actually works.
- cesarb 10y agoMy first guess would be "the MacOS one", since from what I have heard, MacOS tends to have older (sometimes much older) versions of basic system utilities. I don't have a MacOS machine nearby to check, so this is just a guess.
- kalleboo 10y agoWell that and they have BSD rather than GNU versions
- jandrese 10y agoMight be a way to bypass malicious script detectors that see the JPEG header and stop trying to process the file. It will be stopped dead by metadata filters though. Stripping out the comment would be step #1 for those devices.
- ilkkao 10y agoI remember HTML parser was standarized in WHATWG. I guess it never gives up and keeps trying to find valid HTML tags