清理提交的 URL
我有一个网络表单应用程序，允许用户向网站提交图像的 URL。 然后我自己在管理控制台中筛选这些图像，然后将其发布在网站上供所有人查看。他们不必提交图像，它可以是包含图像的页面的链接。
默认情况下，Webforms 可以防止恶意输入，但仅限于将 javascript 注入输入框时。因此它会立即拾取诸如 之类的内容，但不会 http://www .nastysite.com/nastyScript.js 因为这只是一个 URL，并且“可能”是一个有效的图像。
在管理控制台中，我列出了数据列表控件中的所有提交，并使用 asp:Image 控件显示图像以供检查。
如果用户提交恶意脚本，当呈现管理控制台页面时，该脚本是否可以在我的浏览器中执行？我自己尝试过编写一个脚本，该脚本挂载到加载的文档中以显示警报，但没有任何反应。
我认为我应该显示提交的 URL 并呈现它，这样我就可以检查是否有任何奇怪的提交内容。
我担心的另一件事是，如果我批准来自另一个网站的图像 - 他们以后是否可以将有效图像换成令人讨厌的脚本？如果它在 img 标签中，我会假设不是？
我是否忽略了任何潜在的弱点？
I have a webforms app that allows users to submit URLs of images to the site.
These images are then screened by myself in the admin console before making them available on the site for everyone to see. They do not have to submit an image, it could be a link to a page where the image is contained.
Webforms protects against malicious input by default, but only when injecting javascript into the input box. So it will instantly pick up things like <script type="text/javascript">alert('nasty code');</script> but not http://www.nastysite.com/nastyScript.js as this is simply a url, and 'could' be a valid image.
in the admin console i list all submissions in a datalist control and use an asp:Image control to display the image for inspection.
If a user were to submit a malicious script could this be executed in my browser when the admin console page is rendered? I have tried this myself by writing a script that hooks into document loaded to show an alert, and nothing happens.
I figure i should display the submitted URL as well as rendering it so i can check for any odd looking submissions.
One other thing that concerns me is that if i approve an image from another site - could they later swap the valid image out for a nasty script? i would assume not if its in an img tag?
Am i overlooking any potential weaknesses?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
当 Web 浏览器加载资源作为 IMG 标签的 SRC 时，它会将响应解析为图像文件。如果有人将 URL 提交到 JavaScript 文件，结果将只是图像损坏/丢失。
也就是说，外部链接的照片仍然存在安全问题：
正如您已经说过的，有人可以在事后将图像交换为 pr0n。
他们将能够跟踪您网站上看到该图像的所有访问者的 IP 地址、时间戳和浏览器身份。根据访问者的浏览器设置，他们还可以设置 cookie 来跟踪您的用户，因为他们访问您的网站和其他允许类似链接的网站。当然，几乎所有纯图像横幅广告服务都是这样工作的。
如果特定的浏览器容易受到格式错误的图像文件的影响，他们可以将图像交换到这样的文件，这可能会导致用户的浏览器崩溃或锁定。在极端情况下，他们可能会破坏浏览器的安全性。一般来说，浏览器对于畸形图像攻击的防御能力相对较强，但也有可能发现另一种攻击。
理论上，他们可以将图像文件更改为对其他某个 URL 的 302 重定向响应，而该 URL 可能根本不是图像。访问者只会看到损坏的图像，但如果您有足够的流量，他们可以利用这些重定向来在另一个网站上执行 DDoS。 （我将其归入“偏执狂”类别。）
When a web browser loads a resource as the SRC of an IMG tag, it will parse the response as an image file. If someone were to submit a URL to a JavaScript file instead, the result would merely be a broken/missing image.
That said, there are still security concerns with externally-linked photos:
As you've already stated, someone could swap the image out after the fact to, say, pr0n.
They will be able to track the IP address, timestamp, and browser identity of all of the visitors to your site who see the image. Depending on your visitors' browser settings, they could also set cookies to track your users as they visit both your site and others that allow similar linking. This is of course how pretty much all of the image-only banner ad services work.
If a particular browser were susceptible to a malformed image file, they could swap the image out to such a file, which could then crash or lock up the users' browsers. In the extreme case, it could allow them to breach browser security. Browsers in general tend to be relatively hardened against malformed image attacks, but it is a possibility another one could be discovered.
They could theoretically change the image file to a 302 redirect response to some other URL, which might not be an image at all. The visitor would only see a broken image, but if you have enough traffic, they could wield those redirects to, say, perform a DDoS on another web site. (I'd put this in the "paranoia" category.)
从其他站点提取的任何图像都应保存在本地服务器上，就像用户直接上传一样。这不仅可以防止用户在您批准后更改图像，还可以防止在您批准图像后如果父网站将其删除，图像就会失效。
至于清理传入文件 - 是否可以在上传时检查传入文件并获取其内容类型甚至扩展名，并根据良好扩展名列表对其进行验证。例如，用户可能只能提交 png、jpg 和 gif 的图像？
Any images that are pulled from another site should be saved on your local server as if the user had uploaded it directly. Not only does this prevent the user from later changing the image after you've approved it, but it prevents the image from becoming dead after you've approved it should the parent website delete it.
As for sanitizing incoming files - is it possible to check that incoming file at upload time and get its content-type or perhaps even its extension and validate it against a list of good extensions. For instance, users can only submit images that are png, jpg, and gif, perhaps?