Hacker News Reader

Most of the time theses images don't end up in the file system. They are going to the clipboard and then copied to a chat or imgur

View on HN

But in this case it's luckily not vulnerable

Apparently Discord and probably other platforms don't remove the excess data at the end of the file. Maybe they will start doing that now. But for all the existing cropped screenshots out there, it definitely means that there is a vulnerability.

Does the system clipboard API also preserve the excess data, though?

Nope, or at least, not through any obvious paths I've ever seen, including testing just now.

Also, both discord and imgur trimmed an image I uploaded to just the image data. Slack did not, however. I certainly wouldn't want to rely on that behavior, though.

They’ve started doing this.

Reply on news.ycombinator.com