简体   繁体   中英

Prevent hidden files embedded in images from being uploaded to server

I've noticed that it is possible to store hidden files within JPG/GIF/PNG images, which could include illegal images or collections of them in .rar format. Users may exploit this to upload and share illicit content amongst themselves on seemingly average images to the naked eye, on any website that allows image uploading.

I could not find any source on the internet that deals with having PHP prevent image files from containing other files inside of them, and I hope someone can point me in the right direction. The following is not enough to detect additional content within a file, as the exif will still be a match to the file's extension:

if (exif_imagetype($imagefile['tmp_name']), IMAGETYPE_GIF) { //code; }

我不是100%知道这是否行得通,但是也许使用GD / Imagemagick命令创建新图像可能会去除多余的隐藏数据。

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM