Image upload security - reprocess with GD

Question

I\'ve heard that the best way to handle uploaded images is to \"re-process\" them using the GD library and save the processed image. see: PHP image upload secu

Answer 1

function isvalidjpeg($file) 
{ 
$finfo = finfo_open(FILEINFO_MIME_TYPE);
return is_resource($finfo) && 
       (finfo_file($finfo, $file) === 'image/jpeg') && 
       finfo_close($finfo);
}
if(isvalidjpeg($_FILES['file']['tmp_name'])) {
   $newIm = @imagecreatefromjpeg($_FILES['file']['tmp_name']); .....

Answer 2

If the user uploads a JPEG file, you could do something like this to reprocess it:

$newIm = @imagecreatefromjpeg($_FILES['file']['tmp_name']);
if (!$newIm) {
    // gd could not create an image from the source
    // most likely, the file was not a valid jpeg image
}

You could then discard the $newIm image using imagedestroy() and use the uploaded file from the user, or save out the image from GD and use that. There could be some issues with saving the GD image as it is not the original image.

Another simple method would be to check the header (first several bytes) of the image file to make sure it is correct; for example all JPEG files begin with 0xff 0xd8.

See also imagecreatefromstring(), and you can also use getimagesize() to run similar checks on the uploaded image.