As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload images. Even though it is fixed in IE8, there's still a lot of IE7 and before around, so this needs to be addressed. So the question is, how it is best to address it, given:
- PHP site with file uploads
- Not recoding images (i.e. stuff like ImageMagick can't be used)
- Direct access to images should be allowed
- We can not prohibit people from using "wrong" extension
Would checking first 256 bytes for something like <(html|body|img|script|head)> be enough? Any better ways to do it?