4 ms·
I don't know what it is, but I feel uneasy embedding images from an unknown location into my site, even if just for dev. What are other folks thoughts on secur
by seg_lol 6y ago
I don't know what it is, but I feel uneasy embedding images from an unknown location into my site, even if just for dev.
What are other folks thoughts on security or potential downsides? Don't depend on it, even accidentally, It leaks information, if you are running "hidden" on the net, but placekitten.com will still know, images could get replaced, if you bundle the images via server side rendering, could attack imagemagick, and or parsing attacks and potentially include js in the payload.
If I were a dev image replacement service, what information or advantage could I gain?
- Cthulhu_ 6y agoAssuming it's only used in development: - Early information on unreleased software / UIs; maybe you could jump the gun and introduce a concept faster. - Access to customer data, if it's improperly censored / randomized after being pulled from a production database - (advanced) Malware injection - (advanced) Malicious code injection
- loa_in_ 6y agoSince you don't check for the image format you can get served a SVG image with embedded JavaScript and CSS that could potentially run in your website context. It's not that straightforward as just an image tag won't let attackers run any js by default, but inlining the image would.
- dylan604 6y agoI wouldn't suggest doing it as a direct call, but if you write a script that has a few methods of verifying that it actually is an image and then even converts it to a new image, it might be a little more safe. Sure, it might slow things down, but it's for dev, right? But that slowdown might be a good thing. Do you really need all of those images?