用户可以在<img> src 属性？

Question

I'm working on an application where users can provide a url to be used as the src in an <img> element.

What kind of things do I need to look out for to make sure a malicious user can't exploit this feature? I'm already escaping the HTML characters (replacing " with &quot; and so on).

I'd like to know things like whether JavaScript be run from an <img> src attribute and other lesser-known dangers.

Answer 1

I would think the biggest danger here would simply come from the actual image the user chooses. You may want to blacklist certain domains or give the user some acceptable-use information before they choose an image, ensuring they don't display adult or otherwise NSFW content to other users. Parsing the URI they provide and systematically building the image tag is the best way to make sure they can't game the system in any way.