Issues that might arise due to having content disposi...

[#1]

I have already asked the same question before on the forum, sorry for posting again. l asked the following question.

"I am trying to display images (png, jpeg, gif, svg) directly on browser instead of letting the users downloading it. I've read from so many places that having content disposition header as inline might cause some security issues, and it is better to have it as attachment. Can anyone provide me a scenario where this might be a problem?"

From the answers from my previous post, I could see mostly the security issue are caused when a malicious attacker injects a script along with the image. Can we tackle this problem by adding a Content-Security-Policy script-src 'none'? my use case for this question only requires the displaying of the image on browser window, and nothing else.

[Prem_IB]

You can add img-src attribute in CSP header to reliably load images from trusted domains only. 

For more details, please see this - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP 

[Prem_IB]

thanks for the reply kunal. The images I am uploading to clients are already coming from my domain only. but what if one of many authors that are uploading assets to my site, uploads a malicious image. In that time img-src 'self' wouldn't stop the malicious code to be executed on client, right?

[kunal29]

If your concern is regarding authors uploading something bad then you should implement workflow and governance process on publishing images. An author can also put some unwanted text on the page as well. So you should always have a review and approval process in place before anything is published.