Quote from: Maged on November 08, 2011, 09:34:53 PM

Quote from: mjcmurfy on November 08, 2011, 01:38:16 PM

Yes, hosting the images is not worth the trouble. Definitely don't do that.
But there are many ways you can prevent the linking of dynamic images, and thus prevent cookie stuffing.

That is impossible. The only way you can prevent people from linking dynamic images without local hosting is by whitelisting image upload sites where you trust that it is impossible to upload dynamic images.

Quote from: btc_novice on November 08, 2011, 07:22:14 PM

Quote from: SgtSpike on November 08, 2011, 07:12:55 PM

In my mind, a forum is more useful when people can read through a guide with pictures without having to click on each image to display it individually. But I guess not everyone can look past the fractions-of-a-second lost when scrolling past an off-topic picture. Roll Eyes

Agreed. The cookie stuffing exploit is real enough, though. It would be easy enough to add some Javascript to detect whether or not the resource loaded in the img src url is actually an image, and if not, then all users who have Javascript enabled would get a huge warning (and mods could easily see them and delete).

eg:
http://stackoverflow.com/questions/3499941/javascript-check-if-img-src-is-valid
http://stackoverflow.com/questions/3744266/how-can-i-test-if-a-url-is-a-valid-image-in-javascript

All that does is warn the user after the fact. By then, it's too late.

If the attack is cookie stuffing, then you clear your browser cookies-- problem solved. If the attack is CSRF, then you're screwed, BUT, if there is an application/site that is vulnerable to CSRF, that's their problem, not this forum's problem.