News for hackers. Stuff that matters.
Re:When GIFs serve JavaScript by Drakim on Monday November 24, 2014 @03:02AM (#8651449)
> One of the easiest ways to mitigate this vulnerability is to force browsers to download/save all user-uploaded files instead of displaying them. Configure your file server to add a Content-Disposition: attachment; header to all user-uploaded files.

But I can imagine many scenarios were the whole purpose of letting the user upload images is so that you can inline display them on the web (such as a forum avatar picture). Requiring the manual downloading of the image wouldn't be an acceptable solution for most people there.

Re:When GIFs serve JavaScript by kijin on Monday November 24, 2014 @03:47AM (#8651523)
If you use a proper <img> tag to embed an image in a webpage, it will display correctly even if the server sets a Content-Disposition header to force download. The header only makes a difference when you explicitly navigate to the URL of the user-uploaded resource.