Low overhead protection while displaying remote images?

schwim

Hi there everyone!

I'm spitballing on a way to try to protect against remote injection attacks when displaying images hosted elsewhere. Currently, I'm using something I found on the web, which as I understand it is using GD:

<?php

if(@!is_array(getimagesize('http://google.com'))){
	echo "#1 is not an image";
}else{
	echo "#1 is an image";
}
echo "<br>";

if(@!is_array(getimagesize('https://fromnovicetoperfection.files.wordpress.com/2012/10/jesus-our-president.jpg'))){
	echo "#2 is not an image";
}else{
	echo "#2 is an image";
}


?>

but reading up on it, I see a lot of different ways to skin this particular cat. I'm wondering if anyone might have a suggestion on something that would be thorough but also low enough overhead that it could be used every time a page is loaded(like a forum topic page in which people embed images) and not just when it's initially posted. This is in an effort to protect against the file being changed after the initial post is made.

Any thoughts on the matter would be greatly appreciated!

dalecosp

Not sure if I have ideas if much value ....

At OMBE we got tired of dependence on remote image hosts, so now most portions of the system detect the need for the image, fetch the image to one of our boxes, and change the source in the HTML.

schwim

Thanks very much for taking the time to respond!

I considered retrieving the image for local hosting then resizing(even if to the same size) to get rid of any malicious files with spoofed image headers. The reason I didn't go that route is because I worry about copyright claims. If someone links to a web accessible image elsewhere, that's not on me but if I host that same image (or a facsimile of) on my server, I think it might have the capabilities of putting me in hot water.

dalecosp

I suppose that might be true; due to the nature of our project we have implicit permission ....

sneakyimp

It should be apparent that there are two aspects to your check that cause great overhead:
fetching the remote image
parsing the image contents to determine if it's an image

Perhaps you could make this check once and cache the results? Perhaps in a db or something? If not, then I can't really think of any reliable way to check if a remote file is an image. It's not like there's some kind whitelist of all internet images out there.

The hazard of course with caching the results is that the remote file could be changed into something else if you aren't careful. Is that really a problem? Is it going to hurt anyone if you create an <img> tag that points to a non-image? I can imagine this might be dangerous in that one might be able to exploit a security flaw in a browser. Just wondering if it's really all that dangerous.

dalecosp

sneakyimp;11049361 wrote:
The hazard of course with caching the results is that the remote file could be changed into something else if you aren't careful. Is that really a problem? Is it going to hurt anyone if you create an <img> tag that points to a non-image? I can imagine this might be dangerous in that one might be able to exploit a security flaw in a browser. Just wondering if it's really all that dangerous.

Well, [thread=10383861]this[/thread] isn't exactly what you're talking about, but it might have some applicable thoughts....

sneakyimp

Another possibility is to copy the image from its remote location into a CDN (amazon S3 or similar). Not sure if you can afford it but it's pretty cheap to store gazillions of files.

If you were copying all the images, you'd probably need some kind of data to track when they were added so you can eventually expire them.

schwim

Thanks a bunch, sneaky. I've considered AWS in the event that my pet project gains a set of legs and takes off. I noticed during the explosion of cloud file hosting offerings that they were all using Amazon for the hosting end.

sneakyimp

schwim;11049385 wrote:
Thanks a bunch, sneaky. I've considered AWS in the event that my pet project gains a set of legs and takes off. I noticed during the explosion of cloud file hosting offerings that they were all using Amazon for the hosting end.

I've also worked with Rackspace and Digital Ocean. You can get 'droplets' at digitalocean.com (i.e., little virtual servers) for like $10/month or something.

I spent some time familiarizing myself with spinning up a virtual server via Amazon EC2 and allocating cloud servers via Rackspace, etc. I strongly feel that it has dramatically increased my competitiveness as a developer and am happy to help anyone learn the ropes if it looks confusing. The primary benefit is that it's easy to fire up new servers, mail services, etc. when you need them and then simply spin them down when you are done. "Computing on demand" as they say.

As for the CDN stuff like Amazon S3, I have been mightily impressed. If you have a lot of large assets (images, video files, etc.) then you can simply shove them into a CDN and not really worry too much about allocating hard drives or space on your server. It's not quite as simple as writing a file to your file system (you have to make an API call) but you don't have to worry about running out of space and the CDN provider takes care of backing up the files, making them available for download, etc.