Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60473
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <b7af37b0e8d38a500944f542b7ff234e.squirrel@www.l-i-e.com>
References: <b7af37b0e8d38a500944f542b7ff234e.squirrel@www.l-i-e.com>
Date: Sat, 5 May 2012 19:29:59 +0200
Message-ID: <CAH-PCH6oBe1uVtWoLWyr3+FvEVBxaWZNK+JWtRLx6U0FzSgXDQ@mail.gmail.com>
To: Richard Lynch <ceo@l-i-e.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=14dae9cdc12fe5270f04bf4d6260
Subject: Re: [PHP-DEV] JPEG Upload
From: tyra3l@gmail.com (Ferenc Kovacs)

--14dae9cdc12fe5270f04bf4d6260
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Sat, May 5, 2012 at 6:32 PM, Richard Lynch <ceo@l-i-e.com> wrote:

> On Tue, April 10, 2012 1:13 pm, John Crenshaw wrote:
> >In
> > most systems you can upload *anything* with a .jpg extension and the
> > app will take it, so you can still include the file
>
> People don't use imagecreatefromjpeg() to be sure it isn't some ware
> or executable or PHP script disguised as a JPEG?!
>
> That's just crazy.
>
> And inexcusable in a framework.
>
> Somebody might be able to craft a "JPEG" that validates and still
> manages to somehow parse some PHP in the middle... Probably using JPEG
> comments so it's easier.
>
>
yeah, and injecting php code through the jpeg comments isn't new also, see
http://ha.ckers.org/blog/20070604/passing-malicious-php-through-getimagesiz=
e/
but
I bet I could find even older posts discussing the topic.
so imo the correct remedy for this situation is to prevent your uploaded
files to be executed at the first place, instead of trying to write an
error-prone method to detect malicious content inside your uploaded media
files.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--14dae9cdc12fe5270f04bf4d6260--