Hacker News Reader

Comment by gruez | Hacker News Reader

What's stopping a site from loading javascript using a side-channel (encoded inside a png, for example), and then eval-ing the payload? I guess you can prevent this by limiting the amount characters you can send to eval, but I'd imagine it'd break a lot of sites. Plus you can probably bypass the eval limit by rolling your own eval (basically writing a javascript interpreter in javascript)

View on HN

Simple: stop loading those PNGs or strip them of all not-image content. The fact that you can inject code into an image sounds like a security flaw waiting to happen.

Anything medium can be encoded and decoded. You transpile your code into pixels, CSS, whatever medium is considered "ok." Images just happen to be large and so can be used to hold a lot of information. You can't just inherently know what is and isn't encoded information and strip out "the bad stuff."

Those pixels do not execute themselves (or cookies, or headers, or whatever we are still allowing). They still need an interpreter. Interpreters are indeed security flaws. Pushing people away from scannable code and towards hiding their code in other filetypes will cause a proliferation of interpreters, and a proliferation of security flaws.

Image files should only be for images, and what little metadata needed to display them properly. Anything else should be discarded.

What things should and should not be does not affect what they can be. The point is that the image data can be encoded. It's not "extra," it's the actual image itself being used to relay additional information covertly. How do you differentiate between which pixels are "good" and which ones are "bad"? There is no way to know.

To process such a file, you DO need an interpreter that follows the "rules" of the encoding, but the interpreter can be small, concealed, and varied, resulting in a cat and mouse game if you are trying to block such implementations.

Can you define "not-image content"? Steganography begs to differ.

Simple: Any content that isn't required to generate the image.

In this case, the JavaScript is the image. It's all just bytes, they can be decided as pixels or code.

Reply on news.ycombinator.com