advanced · injection

User-Supplied Image URL

Your API downloads an image from a URL supplied by a user. What risks should you consider?

Practical scenario

A thumbnail service fetches customer-supplied URLs.

What it tests

  • • Server network position
  • • Destination validation
  • • Egress