从外部网站渲染图像时如何防止 XSS 攻击
我公司将允许客户将建议发布到我们的网站上。 此功能与 Facebook 分享链接非常相似。 我们的客户将输入一个 URL，我们将抓取网站、检索图像、描述并将描述和图像 URL 保存在我们的数据库中，以供其他客户稍后查看。
我们没有资源来保存/操作外部图像，除非现在绝对有必要，否则我们希望保存图像 URL 并在加载时渲染它。
该功能已经实现，但我有一些顾虑，希望获得一些专家的帮助，以确保我可以防止任何问题的发生。
场景1 客户 A 从网站发布了 5 条建议，其中包含大的高质量图像。我可以在第一次渲染并从网站检索这些图像时防止网站性能受到影响吗？您是否知道只要保留对原始网站的引用，保存本地副本是否违法？我也反对热链接，但不确定在硬盘驱动器中保留副本是否是个好主意。 我注意到 Facebook 不会保存它们，它们总是渲染图像，我确信它们是这样做的，因为这是正确的方法。
b) 客户 B 滥用此功能，并且他实际上尝试进行 XSS 攻击，我如何利用 Anti-XSS 4.0 来确保客户不会尝试 xss 攻击，对输出进行编码就足够了？是否还有其他我不知道的安全风险？
感谢您的帮助！
My company will allow customers to post suggestions to our website.
This feature is very similar to facebook share link.
Our customers will type a URL, we will scrape the site, retrieve the images, description and save the description and the image url in our database for other customers to review them later.
We don't have the resources to save/manipulate external image, unless it is absolutely necessary for now we will like to save the image url and render it onload.
The feature has been implemented but I have some concerns and would like to get some expert help to make sure I can prevent any issue from happening.
Scenario 1
Customer A, posts 5 suggestions from websites which contains large high quality images. Can I prevent the site to get a performance hit the first time I render and retrieve those images from the sites?, do you know if it would be illegal to save a local copy as long as I keep the reference to the original site? also I am against hotlinking but not sure if keeping a copy in my hard drive is a good idea.
I noticed facebook doesn't save them, they always render the image, I am sure they do it that way because that's the right way to do it.
b) Customer B misuses this feature and he actually try to do an XSS attack how can I take advantage of Anti-XSS 4.0 to make sure customer doesn't try an xss attack, encoding the output would be enough? is there any other security risk that I am not aware of?
Thanks for your help!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
谷歌图像和类似网站似乎可以在本地存储图像。向每个网站请求许可是不切实际的。
为了防止 XSS 攻击，请确保客户为您提供 URL 而不是一些 JavaScript。您可以在此处查看一些 XSS 图像攻击示例：http://ha.ckers.org/xss.html
Google images and similar sites seem to get away with storing images locally. Not going to be practical to request permission from every website.
To prevent XSS attacks make sure the customer gives you a URL rather than some JavaScript. You can see some example XSS image attacks here: http://ha.ckers.org/xss.html