Imagejs – A small tool to hide JavaScript inside a valid image file

jklmnn.de

32 points·brbcoding··8 comments

Very cool. However I wonder if someone will try this on sharing sites like facebook to see if it works.

as in the destriction explained, this only works when the image is loaded inside a javascript src tag

An img tag won't execute a script, it need to be the src of the script tag.

I'm curious to see the really specific case where this is needed. What actually will scan to make sure it's an image but then set it as a src on a script tag?

some javascript files are merged over params like ?js=foo.js_bar.js but indeed the attack surface is very small

Ok you would first need to upload the gif on the website and then do that. Yeah interesting, really small attack surface but still one that we should think about.

It's for circumventing Same-origin where you can get a url into a script tag on a page, but it won't execute unless it's from the same origin.

https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...

I'm also curious. First things that pop up in my mind :

1. Hiding javascript one level more ( slightly harder to find what is going on than uglified JS )

2. Avoiding some script blocking scripts ( imagine ad-blocker that is not configured for such javascript option )

3. Saving traffic by putting javascript in the same request as an image resource that you are actually using.

this technique is old - but good to remind someone that this is possible

Reply on news.ycombinator.com