RequestPolicy/requestpolicy — Issue #61: add option to allow all images
Author: jsamuel
Created: 2011-12-22 18:49:25+00:00
State: open
Labels: extension

imported trac ticket
created: 2009-12-13 20:38:42
reporter: justin

A user has requested in #53 an option to allow images. It seems like some variant of this would be useful as an option because it sounds like it could be a common request. However, it has very large privacy and security risks for people wanting strong privacy and security, so I'll have to think about how to properly warn about enabling the option.

Just to be explicit about the risks: if images are enabled based on the guess that a destination url is an image, then it allows CSRF attacks from image tags, for example. Also, such an option allows all user tracking that relies on what appears to be images (whether they are 1x1 pixel tracking images or not even a valid image that is returned).