Re: JPEG Upload

On 05/05/12 20:08, Sanford Whiteman wrote: > This presupposes that your users don't expect embedded metadata to be > preserved when people redownload the images. > > Not only do photo professionals/hobbyists expect you to keep the > metadata, you also should leave it in for reasons of legality. Hosting > a bunch of stripped images can make you look really bad. We only strip > metadata that is known to cause browser display problems (mostly old > IE6/Adobe comment bugs). > > Bottom line is you have to make sure PHP never parses the files. > > -- S. Moreover, that still doesn't protect you, as it would be possible to make a valid image where the payload happened in the image data. I haven't tried to create such malicious image, but I have found legit images that tripped bad-image-detection heuristics looking for a 4-byte magic. Image contents are "a bunch of random bytes", but 'DROP TABLE Students;' is binary data, too.