<p>I have a rich-text editor on my site that I'm trying to protect against XSS attacks. I think I have pretty much everything handled, but I'm still unsure about what to do with images. Right now I'm using the following regex to validate image URLs, which I'm assuming will block inline javascript XSS attacks:  </p>

<pre><code>"https?://[-A-Za-z0-9+&amp;@#/%?=~_|!:,.;]+"
</code></pre>

<p>What I'm not sure of is how open this leaves me to XSS attacks from the remote image. Is linking to an external image a serious security threat?</p>

<p>The only thing I can think of is that the URL entered references a resource that returns "<code>text/javascript</code>" as its MIME type instead of some sort of image, and that javascript is then executed.</p>

<p>Is that possible? Is there any other security threat I should consider?</p>

Another thing to worry about is that you can easily embed PHP code inside an image and upload that most of the time. The only thing an attack would then have to be able to do is find a way to include the image. (Only the PHP code will get executed, the rest is just echoed). Check the MIME-type won't help you with this because the attacker can easily just upload an image with the correct first few bytes, followed by arbitrary PHP code. (The same is somewhat true for HTML and Javascript code).