[issue26337] Bypass imghdr module determines the type of image

Irit Katriel added the comment: imghdr is deprecated as per PEP 594, so there won't be further enhancements to it. -- nosy: +iritkatriel resolution: -> wont fix stage: -> resolved status: open -> closed ___ Python tracker

[issue26337] Bypass imghdr module determines the type of image

Changes by Ramin Farajpour Cami : -- nosy: +serhiy.storchaka ___ Python tracker ___

[issue26337] Bypass imghdr module determines the type of image

Steven D'Aprano added the comment: I'm sorry, I don't understand what you think is the bug here. It looks like you are passing a corrupted file which has a PNG extension but is not actually a PNG file (it contains PHP code). What do you expect should happen? -- nosy: +steven.daprano

[issue26337] Bypass imghdr module determines the type of image

Ramin Farajpour Cami added the comment: images can be served with a content type of text/html,(which means we can certainly inject HTML). -- ___ Python tracker

[issue26337] Bypass imghdr module determines the type of image

Ramin Farajpour Cami added the comment: In normal if you choose a image and open image with editor set codes to image you get error , but I able to bypass image for upload if I use module imghdr for check valid image , booom upload image with malicious code , --

[issue26337] Bypass imghdr module determines the type of image

New submission from Ramin Farajpour Cami: import imghdr imghdr.what('phppng.png') output : 'png' if you set javascript script in file .png or .jpg , output : ValueError: invalid \x escape Hexdump: root@Ramin:~# hexdump -C phppng.png 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52