4 ms·

I was about to "Save as..." when suddenly it struck me that this would be an incredible bait to spread a virus.

• soheil 5y ago
  An image virus? Please do elaborate.
  • lgats 5y ago
    using "filename" within the "Content-Disposition" header, you could theoretically trick a user into downloading a non-image file despite the url containing lisa.jpg I think certain browsers have security limits on the file-extensions you download, which may include when image->"save as" is used.
    • chunkyks 5y ago
      Don't forget that you can literally concatenate jpegs and zipfiles [header at start of jpeg, but at end of zipfile], so the valid jpeg can also be a valid zipfile. Combine that with something like Safari's insistence at automatically exploding zipfiles on download, and you got yourself a party.
  • Moru 5y ago
    "Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)" [0] [0] https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2004/ms04-028 https://docs.microsoft.com/en-us/security-updates/SecurityBu...
    • soheil 5y ago
      It's bizarre to claim image viruses exist today when you link to a nearly 20 year old article about a buggy OS.
      • Moru 5y ago
        If it happened in the worlds most used client OS 20 years ago, it's clearly not impossible it can happen again. Not that much has happened with computers since then. I remember being like you, believing no virus could come from an image or other data. I have been proven wrong enough times since then. We keep assuming things as programmers and sometimes we get it wrong and then there is a new wulnerability.
    • pvillano 5y ago
      there was a more recent case with image metadata parsing that, when the author tried to report it, the image also broke youtrack
• kingcharles 5y ago
  Too late. You already download an image into your cache when you view it.
• cagr 5y ago
  screenshotted it instead