Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60480
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.42 as permitted sender)
Message-ID: <4FA576EB.5040907@gmail.com>
Date: Sat, 05 May 2012 20:52:27 +0200
User-Agent: Thunderbird
MIME-Version: 1.0
To: Sanford Whiteman <swhitemanlistens-software@cypressintegrated.com>
CC: "internals@lists.php.net" <internals@lists.php.net>
References: <b7af37b0e8d38a500944f542b7ff234e.squirrel@www.l-i-e.com> <CAH-PCH6oBe1uVtWoLWyr3+FvEVBxaWZNK+JWtRLx6U0FzSgXDQ@mail.gmail.com> <58e8965ff524a3ff98ba3cbb5028ddba.squirrel@www.l-i-e.com> <CAH-PCH7O=ZNJrxpybSULOdGLHi-nnNk6e9tdW9ko7RPDygpHVA@mail.gmail.com> <613522097.20120505140848@cypressintegrated.com>
In-Reply-To: <613522097.20120505140848@cypressintegrated.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] JPEG Upload
From: keisial@gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)

On 05/05/12 20:08, Sanford Whiteman wrote:
> This presupposes that your users don't expect embedded metadata to be
> preserved when people redownload the images.
>
> Not only do photo professionals/hobbyists expect you to keep the
> metadata, you also should leave it in for reasons of legality. Hosting
> a bunch of stripped images can make you look really bad. We only strip
> metadata that is known to cause browser display problems (mostly old
> IE6/Adobe comment bugs).
>
> Bottom line is you have to make sure PHP never parses the files.
>
> -- S.
Moreover, that still doesn't protect you, as it would be possible to
make a valid image where the payload happened in the image data. I
haven't tried to create such malicious image, but I have found legit
images that tripped bad-image-detection heuristics looking for a 4-byte
magic.
Image contents are "a bunch of random bytes", but 'DROP TABLE Students;'
is binary data, too.