简体繁体 English

使用PHP来防止图像中的XSS攻击

[英]Use PHP to prevent XSS attacks within an image

原文 2012-08-10 17:16:55 3 2 php/ codeigniter/ security/ xss

After reading http://dsecrg.com/files/pub/pdf/XSS_in_images_evasion_bypass_(eng).pdf , it is clear that allowing image uploads from users opens you to XSS attacks. 阅读http://dsecrg.com/files/pub/pdf/XSS_in_images_evasion_bypass_(eng).pdf后，很明显允许用户上传图片会让您受到XSS攻击。

I wasn't able to find any PHP examples of how to screen an uploaded image for XSS attacks. 我无法找到任何关于如何筛选上传图像进行XSS攻击的PHP示例。

I found one for CodeIgniter , which I am using. 我找到了一个CodeIgniter ，我正在使用它。 The function is xss_clean($file, IS_IMAGE) , but there is only 1 sentence of documentation for it, so I have no idea how it works and a comment in their forum said it had an unreasonably high rate of false positives, so it's not usable in production. 该函数是xss_clean($file, IS_IMAGE) ，但它只有一个文档的句子，所以我不知道它是如何工作的，并且在他们的论坛中的评论说它有一个不合理的高误报率，所以它不是可用于生产。

What do you recommend to prevent XSS attacks within an uploaded image? 您建议在上传的图像中防止XSS攻击？

2 个解决方案

As long as you keep the extension correct (and your users are diligent about updating their browser) image injection should not be possible. 只要您保持扩展名正确（并且您的用户都在努力更新其浏览器），就不应该进行图像注入。

For instance, if someone uploads alert('xss'); 例如，如果有人上传alert('xss'); as an image and you have <img src='that-image.png'> , it will be emitted as a png and the JavaScript won't execute (at least back to IE7). 作为一个图像，你有<img src='that-image.png'> ，它将作为一个png发出，JavaScript将不会执行（至少回到IE7）。 What's important is that you rename the images appropriately. 重要的是您要适当地重命名图像。

If you have php > 5.3 and the finfo PECL extension, you can use it to get the mime type of the file and have a whitelist of types you will allow (png, jpg, gif I would imagine). 如果您有php> 5.3和finfo PECL扩展，您可以使用它来获取文件的mime类型并且具有您允许的类型的白名单（png，jpg，我想象的gif）。 If you are on a Linux machine, file may help you with that as well. 如果您使用的是Linux机器，那么file也可以为您提供帮助。

In CodeIgniter there's many way to prevent the XSS. 在CodeIgniter中，有许多方法可以阻止XSS。 You can enable it when getting the value like ->post('data', true). 您可以在获取值时启用它，例如 - > post（'data'，true）。 The second parameter is the XSS bool. 第二个参数是XSS bool。

Also, don't use the HTML IMG tag. 另外，请勿使用HTML IMG标记。 Use the CodeIgniter one that will clean, look and make it easier to display the image. 使用CodeIgniter，它将清理，查看并更容易显示图像。

Just my two cents! 只是我的两分钱！