Re: CSP & data URIs

Keep in mind that an attacker who can inject an <img> tag into your
site can use a data URL to display whatever image he or she likes.
Adding data: as a src does increase the risk from an XSS attack.

Adam


On Thu, Jan 10, 2013 at 7:33 AM, Yoav Weiss <yoav@yoav.ws> wrote:
> OK, my mistake.
> In that case, I understand that enabling "img-src data:" in CSP can be
> recommended as part of a Web performance best practice.
>
>
> On Thu, Jan 10, 2013 at 4:02 PM, Boris Zbarsky <bzbarsky@mit.edu> wrote:
>>
>> On 1/10/13 9:44 AM, Yoav Weiss wrote:
>>>
>>> It seems that at least in some browsers, img data URIs are XSS
>>> exploitable[1][2].
>>
>>
>> Uh.... no.  They're not.  What made you think they are, exactly?  The
>> links you point to certainly say nothing of the sort.
>>
>> -Boris
>>
>