4 ms·

Well websites are stupid if they don't reencode user-uploaded images for precisely this reason... Otherwise an evil client uploads a malicious webp image, whic

Well websites are stupid if they don't reencode user-uploaded images for precisely this reason... Otherwise an evil client uploads a malicious webp image, which then gets hosted and 'shared' by the server to other users, who upon viewing said image get exploited and share more malicious images...

masklinn 3y ago
Unless you mean the client should transcode before upload (which they can, mind) that mostly makes the server exploitable.
- mortehu 3y ago
  You'd set up the server so that it's okay if it gets exploited. For example, maybe its only job is decoding images.
  - michaelt 3y ago
    If an exploit gives you remote code execution on the image transcoding server, you can simply change the transcode operation into a pass through. Hell, you could even start adding your payload to other users' uploads.
    - mortehu 3y ago
      I said the decoder, not the encoder.
- jiofj 3y ago
  Then transcode in a different server. Not transcoding user-uploaded files is borderline negligent.
  - account42 3y ago
    Transcoding images is why all old pictures on the web a a blocky mess of unholy JPEG.
    - londons_explore 3y ago
      There are ways to transcode images in such a way that if they're downloaded and reuploaded to your service you don't lose any further quality in your re-upload.
  - kroltan 3y ago
    As someone who shared a good deal of Spore creations over the internet, I disagree. (The game would generate a "card" with a visual preview, but would stuff the XML encoding of the creation into some PNG metadata field so the image could be dragged onto someone else's game.)
- dns_snek 3y ago
  The server is usually processing the images anyway, at the very least to remove EXIF metadata, but also to resize and compress the images for different resolutions.
nocsi 3y ago
100% Websites that accept complex media from users really are stupid. It’s bad enough sanitizing other input, but the added costs with transcoding and storing user content, all the meanwhile exposing unnecessary risk to processes. I’d just pipe the media upload to Cloudflare and have them deal with it
saagarjha 3y ago
Reencoding images doesn’t mean they’re not exploitable anymore.
Jigsy 3y ago
https://xkcd.com/1683/ https://xkcd.com/1683/

masklinn 3y ago

Unless you mean the client should transcode before upload (which they can, mind) that mostly makes the server exploitable.

mortehu 3y ago
You'd set up the server so that it's okay if it gets exploited. For example, maybe its only job is decoding images.
- michaelt 3y ago
  If an exploit gives you remote code execution on the image transcoding server, you can simply change the transcode operation into a pass through. Hell, you could even start adding your payload to other users' uploads.
  - mortehu 3y ago
    I said the decoder, not the encoder.
jiofj 3y ago
Then transcode in a different server. Not transcoding user-uploaded files is borderline negligent.
- account42 3y ago
  Transcoding images is why all old pictures on the web a a blocky mess of unholy JPEG.
  - londons_explore 3y ago
    There are ways to transcode images in such a way that if they're downloaded and reuploaded to your service you don't lose any further quality in your re-upload.
- kroltan 3y ago
  As someone who shared a good deal of Spore creations over the internet, I disagree. (The game would generate a "card" with a visual preview, but would stuff the XML encoding of the creation into some PNG metadata field so the image could be dragged onto someone else's game.)
dns_snek 3y ago
The server is usually processing the images anyway, at the very least to remove EXIF metadata, but also to resize and compress the images for different resolutions.

nocsi 3y ago

100% Websites that accept complex media from users really are stupid. It’s bad enough sanitizing other input, but the added costs with transcoding and storing user content, all the meanwhile exposing unnecessary risk to processes. I’d just pipe the media upload to Cloudflare and have them deal with it

saagarjha 3y ago

Reencoding images doesn’t mean they’re not exploitable anymore.

Jigsy 3y ago

https://xkcd.com/1683/ https://xkcd.com/1683/