Using user editable image URL in application. Security issues.

Posted by sharas on Stack Overflow See other posts from Stack Overflow or by sharas
Published on 2010-05-21T19:06:22Z Indexed on 2010/05/21 19:10 UTC
Read the original article Hit count: 150

Filed under:

ruby-on-rails

|

assets

|

image

|

validation

|

xss

Hi there.

I am writing an application where users are required to show their photo, however as my server resources are very limited I can not let them upload it to the server.

So I have three major questions:

1. How to properly validate photo URL? At least I can validate with regexp, however I need to check for file ending:

`validates_format_of :photo_url, :with => URI::regexp(%w(http https))`

2. Security issues? XSS?

Even I validate the picture at the moment of creation, hacker can replace image with malicious stuff anytime.

3. Maybe there are free asset stores with API?

© Stack Overflow or respective owner

Related posts about ruby-on-rails

Ruby on Rails - How can I start? [closed]

as seen on Programmers - Search for 'Programmers'
I have misconception in understanding the relationship between Ruby language and Ruby on Rails Framework. Because of 'I am an absolute beginner' in web development I have no idea if I have to grasp the fundamentals of Ruby before I go with Ruby on Rails! I also want to ask who is behind both Ruby… >>> More
DES3 decryption in Ruby on Rails

as seen on Stack Overflow - Search for 'Stack Overflow'
My RoR server receives a string, that was encrypted in C++ application using des3 with base64 encoding The cipher object is created so: cipher = OpenSSL::Cipher::Cipher::new("des3") cipher.key = key_str cipher.iv = iv_str key_str and iv_str: are string representations of key and initialization… >>> More
Ruby on rails: Image downloads with Authentication/Authorization/Time outs

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Guys, I'm having few doubts on implementing file downloads. I'm creating an app where I use attachment_fu with Amazon s3 to upload files. Things are working pretty well so far on uploading side. Now its the time to start the file downloads. Here is what I need, a logged in user search and browse… >>> More
Ruby on Rails deployment, on "thin" server with lot of attachments

as seen on Stack Overflow - Search for 'Stack Overflow'
A lot of PDFs are stored inside MySQL as a BLOB field for each PDF file. The average file size is 500K each. The Rails app will stream the :binary data as file downloads, where there is a user click on the download link. Assume there is a maximum of 5 users downloading 5 PDFs concurrently, what… >>> More
Apply Behavior Driven Development to Ruby on Rails with Rspec

as seen on Internet.com - Search for 'Internet.com'
Applying the Behavior Driven Development (BDD) methodology to your Rails development takes you beyond traditional Test Driven Development. Learn how to do it with the Ruby-based BDD framework RSpec. >>> More

Related posts about assets

Asset Pipeline acting up

as seen on Stack Overflow - Search for 'Stack Overflow'
Ok, so my asset pipeline has suddenly started acting up on my development machine. JS functions that previously worked are now throwing "not a function" errors.. I know I must be doing something wrong. A minute ago the datatables jquery function was working, then it was throwing an error, then it… >>> More
How to improve performance of map that loads new overlay images

as seen on Pro Webmasters - Search for 'Pro Webmasters'
I have inherited a website to maintain that uses a html map overlaying a real map to link specific countries to specific pages. previously it loaded the default map image, then with some javascript it would change the image src to an image with that particular country in a different colour on mouseover… >>> More
For Sale: Linux OS and Other Assorted Assets

as seen on Internet.com - Search for 'Internet.com'
OS Roundup: A New York hedge fund has made an offer to buy Novell. Is it paying $2 billion just for the Linux OS, or is there more to it? And, more importantly, will the offer bring other players to the fore. Perhaps Microsoft will end up the white knight in this strange tale. >>> More
For Sale: Linux OS and Other Assorted Assets

as seen on Internet.com - Search for 'Internet.com'
OS Roundup: A New York hedge fund has made an offer to buy Novell. Is it paying $2 billion just for the Linux OS, or is there more to it? And, more importantly, will the offer bring other players to the fore. Perhaps Microsoft will end up the white knight in this strange tale. >>> More
For Sale: Linux OS and Other Assorted Assets

as seen on Internet.com - Search for 'Internet.com'
<b>Serverwatch:</b> "The enterprise Linux space has suddenly got very interesting following the news that a bunch of sharp-suited New Yorkers have made an offer to buy SUSE Linux's parent company, Novell." >>> More