Hacker News Reader

Comment by londons_explore | Hacker News Reader

Well websites are stupid if they don't reencode user-uploaded images for precisely this reason...

Otherwise an evil client uploads a malicious webp image, which then gets hosted and 'shared' by the server to other users, who upon viewing said image get exploited and share more malicious images...

View on HN

100% Websites that accept complex media from users really are stupid. It’s bad enough sanitizing other input, but the added costs with transcoding and storing user content, all the meanwhile exposing unnecessary risk to processes. I’d just pipe the media upload to Cloudflare and have them deal with it

Unless you mean the client should transcode before upload (which they can, mind) that mostly makes the server exploitable.

You'd set up the server so that it's okay if it gets exploited. For example, maybe its only job is decoding images.

If an exploit gives you remote code execution on the image transcoding server, you can simply change the transcode operation into a pass through. Hell, you could even start adding your payload to other users' uploads.

I said the decoder, not the encoder.

Then transcode in a different server.

Not transcoding user-uploaded files is borderline negligent.

Transcoding images is why all old pictures on the web a a blocky mess of unholy JPEG.

There are ways to transcode images in such a way that if they're downloaded and reuploaded to your service you don't lose any further quality in your re-upload.

As someone who shared a good deal of Spore creations over the internet, I disagree.

(The game would generate a "card" with a visual preview, but would stuff the XML encoding of the creation into some PNG metadata field so the image could be dragged onto someone else's game.)

The server is usually processing the images anyway, at the very least to remove EXIF metadata, but also to resize and compress the images for different resolutions.

Reencoding images doesn’t mean they’re not exploitable anymore.

https://xkcd.com/1683/

Reply on news.ycombinator.com