6 ms·

I'm sure there's no ill intent here, but I don't think it's a good practice to hotlink. If those running stdicon were so inclined (or if they were hacked), the

• Ysx 17y ago
  With <img> tags? Is that possible?
  • nopal 17y ago
    Yes. http://ha.ckers.org/xss.html http://ha.ckers.org/xss.html
    • Ysx 17y ago
      You're building the URL yourself though, e.g http://www.stdicon.com/mp3?size=16 http://www.stdicon.com/mp3?size=16. If you're not escaping, maybe a user could upload a file named "evilfile.<script>alert('evil')</script>", but I'm not sure how stdicon.com could initiate an attack from their end.
      • nopal 17y ago
        Now that I actually try it, I think you're right. I had assumed that the browser would load the external JavaScript, parse it and execute the code. I understood that the code in the page (the src built by the coder) was not going to be compromised. I should have realized that the browser would treat data loaded through an img src tag differently than it would data loaded through a script src tag. Some versions of IE can be fooled into executing JavaScript contained in an image file, but the image has to be loaded on its own (in an iframe or a new window), so it wouldn't apply to my original comment. (http://www.splitbrain.org/blog/2007-02/12-internet_explorer_facilitates_cross_site_scripting http://www.splitbrain.org/blog/2007-02/12-internet_explorer_...) This site does still seem like it could lead to security issues. Couldn't they return a 302 redirect header to a private resource? HTTP/1.1 302 Found Location: http://www.yoursite.com/blog/entries/delete/123
        • ptarjan 17y ago
          Yes, but so could anyplace you hotlink images from. gravitar, imgur, youtube preview...