Web Wiz - Green Windows Web Hosting
Web Wiz Homepage Search Web Wiz

  New Posts New Posts RSS Feed - image upload problem with Adobe CS3?
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

image upload problem with Adobe CS3?
 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
dfrancis View Drop Down
Senior Member
Senior Member


Joined: 16 March 2005
Location: United States
Status: Offline
Points: 442 		Post Options Post Options   Thanks (0) Thanks(0)   Quote dfrancis Quote  Post ReplyReply Direct Link To This Post Topic: image upload problem with Adobe CS3?
    Posted: 07 January 2008 at 5:10pm
Hey Bruce,
 
I noticed in the version notes
 
"2. functions/functions_upload.asp - fixed upload image issue when images are created in Adobe CS3"
 
Can you explain what the problem (and solution) was?
“If you want things to be different, you must be willing to do different things!”David Francis
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 07 January 2008 at 5:58pm
IE having as many security holes as a piece of cheese, will run scripting code hidden in an image file as script, thus a hacker can hide malicious scripting code in a file which appears to be an image. Other browsers won't run the scripting code but IE does!

This issue was dealt with in previous releases of Web Wiz Forums to protect those people silly enough to run a security hole like IE, by scanning uploaded images for malicious code.

This works fine except with images created in Adobe Photoshop  were Adobe hide XML within the image file containing some image properties, and details of the Adobe sofwtare that created or edited the image file.

The solution was to strip Adobe's hidden XML content from images before checking the file for malicious code, thus preventing the image from being rejected for having the hidden content.
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 07 January 2008 at 6:03pm
This is the type of XML Adobe appends to the end of an image:-


<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="3.1.1-112">
   <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
      <rdf:Description rdf:about=""
            xmlns:xapMM="http://ns.adobe.com/xap/1.0/mm/">
         <xapMM:DocumentID>uuid:9610BF8166AEDC11AC11AC3F8BCA2200</xapMM:DocumentID>
         <xapMM:InstanceID>uuid:9710BF8166AEDC11AC11AC3F8BCA2200</xapMM:InstanceID>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:xap="http://ns.adobe.com/xap/1.0/">
         <xap:CreateDate>2007-12-10T17:20:45-06:00</xap:CreateDate>
         <xap:ModifyDate>2007-12-19T13:15:13-06:00</xap:ModifyDate>
         <xap:MetadataDate>2007-12-19T13:15:13-06:00</xap:MetadataDate>
         <xap:CreatorTool>Adobe Photoshop CS2 Windows</xap:CreatorTool>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:dc="http://purl.org/dc/elements/1.1/">
         <dc:format>image/jpeg</dc:format>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/">
         <photoshop:ColorMode>3</photoshop:ColorMode>
         <photoshop:History/>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:tiff="http://ns.adobe.com/tiff/1.0/">
         <tiff:Orientation>1</tiff:Orientation>
         <tiff:XResolution>720000/10000</tiff:XResolution>
         <tiff:YResolution>720000/10000</tiff:YResolution>
         <tiff:ResolutionUnit>2</tiff:ResolutionUnit>

<tiff:NativeDigest>256,257,258,259,262,274,277,284,530,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;C205A82675DFD493628EFA61EB26CFFF</tiff:NativeDigest>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:exif="http://ns.adobe.com/exif/1.0/">
         <exif:PixelXDimension>100</exif:PixelXDimension>
         <exif:PixelYDimension>100</exif:PixelYDimension>
         <exif:ColorSpace>-1</exif:ColorSpace>

<exif:NativeDigest>36864,40960,40961,37121,37122,40962,40963,37510,40964,36867,36868,33434,33437,34850,34852,34855,34856,37377,37378,37379,37380,37381,37382,37383,37384,37385,37386,37396,41483,41484,41486,41487,41488,41492,41493,41495,41728,41729,41730,41985,41986,41987,41988,41989,41990,41991,41992,41993,41994,41995,41996,42016,0,2,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,20,22,23,24,25,26,27,28,30;BB7CEADA91F72DEAF25ED3D97F85DB3C</exif:NativeDigest>
      </rdf:Description>
   </rdf:RDF>
</x:xmpmeta>
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
dfrancis View Drop Down
Senior Member
Senior Member


Joined: 16 March 2005
Location: United States
Status: Offline
Points: 442 		Post Options Post Options   Thanks (0) Thanks(0)   Quote dfrancis Quote  Post ReplyReply Direct Link To This Post Posted: 07 January 2008 at 6:27pm
Thanks... that is very interesting. I've recently become quite familiar with Adobe cs3 as well as MAC due to the new magazine. Image management is huge in my business more than ever and that hidden EXIF data is most useful. But I can see how it is not necessary on avatars that's for sure.
 
Thanks for the explanation my friend.
“If you want things to be different, you must be willing to do different things!”David Francis
Back to Top
Ritchie View Drop Down
Groupie
Groupie
Avatar

Joined: 14 June 2005
Location: Russian Federation
Status: Offline
Points: 91 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Ritchie Quote  Post ReplyReply Direct Link To This Post Posted: 15 January 2008 at 11:07am

Hello, Bruce!
We still have a problem with uploading of the images. Here http://www.videozona.ru/imgs/try_it.jpg you can find the photo saved in Adobe CS2. When we try to upload it we get a message about wrong file format.
Чем дальше в лес, тем толще партизаны
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 15 January 2008 at 11:25am
We now have a bunch of images created in different versions of Photoshop to test with and have found a few other issues.

It seems that the XML created by Adobe isn't always formatted in the same way and in the same case!

We are working on trying to fix this, then again if Microsoft finally patch the image vulnerability bug in IE that we are trying to protect against we may not need to parse images anymore and thus not have this issue with Adobe created images.



Edited by -boRg- - 15 January 2008 at 12:33pm
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
StarDust View Drop Down
Senior Member
Senior Member


Joined: 14 May 2007
Location: Bangladesh
Status: Offline
Points: 310 		Post Options Post Options   Thanks (0) Thanks(0)   Quote StarDust Quote  Post ReplyReply Direct Link To This Post Posted: 15 January 2008 at 4:36pm
-boRg-,

I think with CS3, firefox causes the same problem. It has to do something with the way photoshop saves the metadata into a jpeg.
Tips, mods and skins for WWF v9.x
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 15 January 2008 at 5:09pm
It doesn't matter what browser you use to upload the image it has to be parsed for malicious code as you don't know what browser the person viewing the image at a later date will be using.

You also want to keep malicious code off the server so although the parsing of images for malicious code is done to protect IE uses viewing the image, it's also good practice not to have the malicious code on the server in the first place.

The problem with image saved in Photoshop and other Adobe software is that it places XML code into the JPEG image. This then gets flagged up as malicious code because of some of the content of the XML adobe places into the JPEG.

The added problem of trying to detect this is that the XML isn't constant as it's not always the same.

The problem is trying to find away to skan the adobe images without then being flagged as containing malicious code. If you are not careful then a hacker could get round the protection by hiding the malicious code with the Adobe XML making it very difficult to spot, especially as Adobes XML is not constant.

I personally am glad I don't use Photoshop, as what is the point in compressing a JPEG image to as small as possible for the web if Adobe are then going to blot it with a load of hidden XML. OK it's only 3kb, but if you have allot of images on a page that can mount up.

This XML information is olny useful to the person who created the image and to Adobe for tracking how many images are made in their software, so if you are saving for the web I don't think Adobe should not be hiding this XML in the JPEG.
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.

Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.