Issues that might arise due to having content disposition inline on images | Community
Skip to main content
A
aemAmateur
Level 2
February 21, 2021
Solved

Issues that might arise due to having content disposition inline on images

  • February 21, 2021
  • 2 replies
  • 4068 views

I have already asked the same question before on the forum, sorry for posting again. l asked the following question.

 

"I am trying to display images (png, jpeg, gif, svg) directly on browser instead of letting the users downloading it. I've read from so many places that having content disposition header as inline might cause some security issues, and it is better to have it as attachment. Can anyone provide me a scenario where this might be a problem?"

 

From the answers from my previous post, I could see mostly the security issue are caused when a malicious attacker injects a script along with the image. Can we tackle this problem by adding a Content-Security-Policy script-src 'none'? my use case for this question only requires the displaying of the image on browser window, and nothing else.

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by raj_mandalapu

@aemamateur the file which contains executable code is recommended to be downloaded, for example XML, SVG, txt, etc. let us take a simple use case, usually, we use a .svg file to render the images, but at the same time, you can also execute javascript within the SVG file. The problem with this is if you open the SVG within the browser then there is a chance that the attackers can run malicious code in the browser. 

In this case, you need to set the correct mime type that is image/svg+xml and also use  Content-Security-Policy: script-src ‘none’ to disable the javascript execution while loading the SVG file in the browser.

It is good that create and upload .svg file only from the developers. if you give it to the end-user or content authors then you need to set up proper governance and everything should be reviewed and approved.

 

 

 

2 replies

Kunal_Gaba_
Kunal_Gaba_
February 22, 2021

You can add img-src attribute in CSP header to reliably load images from trusted domains only. 

 

For more details, please see this - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP 

 

    A
    aemAmateurAuthor
    Level 2
    February 22, 2021
    thanks for the reply kunal. The images I am uploading to clients are already coming from my domain only. but what if one of many authors that are uploading assets to my site, uploads a malicious image. In that time img-src 'self' wouldn't stop the malicious code to be executed on client, right?
    raj_mandalapu
    raj_mandalapuAccepted solution
    Level 7
    February 22, 2021

    @aemamateur the file which contains executable code is recommended to be downloaded, for example XML, SVG, txt, etc. let us take a simple use case, usually, we use a .svg file to render the images, but at the same time, you can also execute javascript within the SVG file. The problem with this is if you open the SVG within the browser then there is a chance that the attackers can run malicious code in the browser. 

    In this case, you need to set the correct mime type that is image/svg+xml and also use  Content-Security-Policy: script-src ‘none’ to disable the javascript execution while loading the SVG file in the browser.

    It is good that create and upload .svg file only from the developers. if you give it to the end-user or content authors then you need to set up proper governance and everything should be reviewed and approved.

     

     

     

      Terms & ConditionsAccessibility statement

      Loading footer...