4 ms·
Or to re-encode images on upload. Sure, it'll take a bit of compute time, but it would protect you from this and similar attacks.
by a-priori 18y ago
Or to re-encode images on upload. Sure, it'll take a bit of compute time, but it would protect you from this and similar attacks.
- staunch 18y agoI think most sites that allow image uploading do convert and/or scale the images. In most cases this should completely thwart this attack.
- kogir 18y agoMy site validates and re-encodes all images. I thought this was common practice?
- jonknee 18y agoThere are a large number of sites that don't. I coded a photo gallery for a group of Photoshop users and it was required to not change the photo uploads unless they were out of the max size spec. They like the images to look exactly like they exported them out of Photoshop.
- jauco 18y agoI believe you can safely re-encode gifs without extra loss. (the encoding is also lossless for files with less than 256 individual colors)