Re: PHP Security

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



--- Richard Lynch <ceo@xxxxxxxxx> wrote:
> There are times when one needs to parse a file that ends in .jpg
> (or .jpeg) as PHP.

I can't think of any, unless it's prove that you can do it. :-)

> Specifically, broken browsers (various versions of IE) that ignore
> Content-type: headers and use the URL to determine the MIME
> type will not correctly display a URL such as:
> 
> http://l-i-e.com/gd_example.php

IE still ignores Content-Type in most cases (way to go, Microsoft), but
this problem doesn't exist in recent versions, to my knowledge.

> Said browser will, however, correctly handle:
> http://l-i-e.com/gd_example.jpg
> 
> Note that both images are dynamic and, in fact, the two source
> files are Linux symbolic (hard) links, as is this PHP source code:
> http://l-i-e.com/gd_example.phps

There are better ways to do this than parsing .jpg files as PHP. One
obvious one is:

http://example.org/image.php/foo.jpg

Another one that I've seen referenced frequently (especially back when
this was a larger and more common problem) is this:

http://example.org/image.php?iesucks=foo.jpg

Chris

=====
Chris Shiflett - http://shiflett.org/

PHP Security - O'Reilly     HTTP Developer's Handbook - Sams
Coming Soon                 http://httphandbook.org/

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux