4 ms·

Simple: stop loading those PNGs or strip them of all not-image content. The fact that you can inject code into an image sounds like a security flaw waiting to h

Simple: stop loading those PNGs or strip them of all not-image content. The fact that you can inject code into an image sounds like a security flaw waiting to happen.

DCoder 8y ago
Can you define "not-image content"? Steganography begs to differ.
- sneakernets 8y ago
  Simple: Any content that isn't required to generate the image.
  - Technetium_Hat 8y ago
    In this case, the JavaScript is the image. It's all just bytes, they can be decided as pixels or code.
IggleSniggle 8y ago
Anything medium can be encoded and decoded. You transpile your code into pixels, CSS, whatever medium is considered "ok." Images just happen to be large and so can be used to hold a lot of information. You can't just inherently know what is and isn't encoded information and strip out "the bad stuff." Those pixels do not execute themselves (or cookies, or headers, or whatever we are still allowing). They still need an interpreter. Interpreters are indeed security flaws. Pushing people away from scannable code and towards hiding their code in other filetypes will cause a proliferation of interpreters, and a proliferation of security flaws.
- sneakernets 8y ago
  Image files should only be for images, and what little metadata needed to display them properly. Anything else should be discarded.
  - IggleSniggle 8y ago
    What things should and should not be does not affect what they can be. The point is that the image data can be encoded. It's not "extra," it's the actual image itself being used to relay additional information covertly. How do you differentiate between which pixels are "good" and which ones are "bad"? There is no way to know. To process such a file, you DO need an interpreter that follows the "rules" of the encoding, but the interpreter can be small, concealed, and varied, resulting in a cat and mouse game if you are trying to block such implementations.

Simple: stop loading those PNGs or strip them of all not-image content. The fact that you can inject code into an image sounds like a security flaw waiting to happen.

DCoder 8y ago

Can you define "not-image content"? Steganography begs to differ.

sneakernets 8y ago
Simple: Any content that isn't required to generate the image.
- Technetium_Hat 8y ago
  In this case, the JavaScript is the image. It's all just bytes, they can be decided as pixels or code.

IggleSniggle 8y ago

Anything medium can be encoded and decoded. You transpile your code into pixels, CSS, whatever medium is considered "ok." Images just happen to be large and so can be used to hold a lot of information. You can't just inherently know what is and isn't encoded information and strip out "the bad stuff." Those pixels do not execute themselves (or cookies, or headers, or whatever we are still allowing). They still need an interpreter. Interpreters are indeed security flaws. Pushing people away from scannable code and towards hiding their code in other filetypes will cause a proliferation of interpreters, and a proliferation of security flaws.

sneakernets 8y ago
Image files should only be for images, and what little metadata needed to display them properly. Anything else should be discarded.
- IggleSniggle 8y ago
  What things should and should not be does not affect what they can be. The point is that the image data can be encoded. It's not "extra," it's the actual image itself being used to relay additional information covertly. How do you differentiate between which pixels are "good" and which ones are "bad"? There is no way to know. To process such a file, you DO need an interpreter that follows the "rules" of the encoding, but the interpreter can be small, concealed, and varied, resulting in a cat and mouse game if you are trying to block such implementations.