防止恶意外部脚本
我目前正在使用 PHP 和 MySql 开发游戏。 我希望允许用户能够使用 BBCode 解析器 (NBBC) 显示图像，但我已经已意识到潜在的安全问题。
请允许我解释一下：
用户使用 [img]http://example.com/image1.png[/img] 等代码将 URL 输入到文本区域框中
然后，用户可以将外部服务器上的 image1.png 编辑为存储用户信息的服务器端脚本（ 然后，用户可以将外部服务器上的 image1.png 编辑为存储用户信息（ip 等）等
用户使用信息做一些可能令人讨厌的事情！
我的问题是，我们如何防止这种情况发生并在与外部来源详细信息时保护用户详细信息？
显而易见的答案是只允许上传到您的网站，但在这种情况下，这似乎不太实际。
感谢任何帮助！
I'm currently developing a game using PHP and MySql.
I'd like to allow users to be able to show images using a BBCode parser (NBBC) but i've been made aware of a potential security problem.
Allow me to explain:
The user enters a URL into a textarea box using code such as [img]http://example.com/image1.png[/img]
The user can then edit image1.png on the external server into a server side script that stores the user information (ip ect) and so forth.
User uses information to do some potentially nasty stuff!
My question is, how do we prevent this from happening and protect the users details when detailing with external sources?
The obvious answer is to only allow uploads to your site, but in this case, that really doesn't seem too practical.
Appreciate any help!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
实际上，您可以通过更改
为类似的内容：
以便您的代理将加载图像而不是用户。
Actually you can by changing
into something like:
So that your proxy would load the image instead of the user.
你不能，因为对于你的脚本来说，它看起来像真实的图像，并且无法检测到任何不同。
任何机构都可以使用 .htaccess/ForceType 来更改任何文件的执行类型、获取用户信息并提供图像作为响应。
我在很多个月前编写了一个简单的脚本，用于在用户论坛签名中旋转图像，它演示了这个过程： http://blog.simonholywell.com/post/374221718/flickering-images
You can't because to your script it will look like a genuine image and there is no way of detecting anything different.
Any body can use .htaccess/ForceType to change the execution type of any file, grab user information and serve up an image in response.
I wrote a simple script for rotating images in a users forum signature many moons ago and it demonstrates this process: http://blog.simonholywell.com/post/374221718/flickering-images
你不知道。
恶意用户能够获得的唯一信息是用户的 IP 地址和引荐来源网址 URI，因此您只需确保它不会传输任何有价值的信息（例如会话 ID，您可以将其绑定到 IP 地址或通过 Cookie 传输） ）。
You don't.
The only information the malicious user will be able to get is user's IP address and referrer URI, so you only need to make sure that nothing valuable is transmitted by it, (like session id, which you can bind to IP address or transfer via cookies).
甚至不需要将该图像变成脚本。远程服务器的访问日志将捕获图像请求，就像捕获对服务器的任何其他请求一样。 IP、浏览器 UA、引用站点等...
如果您在用户提供的数据中允许外部资源，则您无法控制这些资源的处理方式。如果这张图片是一个头像（比如说），那么没有什么表明远程用户不能将他们的头像最初设置为小狗，然后在最初的小狗图片获得批准后对其进行一些令人讨厌的更改。
没有说用户不能将头像 URL 指向不属于自己的服务器，在这种情况下，其他服务器的运营商会对带宽盗窃感到恼火，并将头像图片制作成山羊类型的图像以取回在带宽窃贼处。
简而言之，如果你允许外部资源，你就会失去控制。将所有东西都放在家里以便您可以密切关注。
It wouldn't even be necessary to turn that image into a script. The remote server's access log would capture the image request as it would any other request to a server. IP, browser UA, referer, etc...
If you allow external resources in user-provided data, you have no control whatsoever over how those resources are processed. If this image was for an Avatar (say), then nothing says the remote user can't make their avatar a puppy initially, then change it something nasty later on after the initial puppy picture's been approved.
Nothing says that the user couldn't point the avatar URL to a server they don't own themselves, in which case that other server's operator would get annoyed at the bandwidth theft and make the avatar picture into a Goatse-type image to get back at the bandwidth thief.
In short, if you allow external resources, you lose control. Keep everything in house where you can keep tabs on it.
尽管回复说这不是问题，但事实确实如此。有多种方法可以创建在用户 PC 上执行的恶意图像文件。您也无法控制用户的浏览器是否支持第 3 方服务器返回的 MIME 类型，以便它可以返回可执行文件而不是图像，即使您可能只允许链接到具有图像扩展名（.png、. gif、.jpg 等）。这种交互完全发生在您的用户和第三方服务器之间，但由于它嵌入在您的页面中，因此用户体验将是任何感染都源自您的网站。
但即使假设远程服务器只发送图像，您也不知道该图像是否安全。请参阅：
gifar 图像漏洞
受感染的 .png 文件
恶意代码隐藏在 jpg 中
将图像上传到您的网站是不行的也可以在公园里散步，如此处所述。
Despite the responses saying this isn't a problem, it is. There are several ways to create a malicious image file that executes on the user's PC. You also have no control over whether the user's browser will honor the MIME type returned by the 3rd party server so it could return an executable file instead of an image, even though you may only allow links to files with image extensions (.png, .gif, .jpg, etc.). That interaction is entirely between your user and the 3rd party server but because it's embedded in your page the user experience will be that any infection originated from your site.
But even assuming the remote server only sends an image, you don't know if the image is even safe. See:
gifar image vulnerability
Infected .png files
Malicious code hides in jpgs
Uploading the images to your site is no walk in the park either, as discussed here.
你在这里过于偏执了。如果用户仅仅因为知道自己的 IP 就容易受到攻击，那么他们的计算机就已经感染了一百种不同的恶意软件。
You're being overly paranoid here. If a user is vulnerable just by having their IP known, their machine is already infested with a hundred different pieces of malware.