Should show images

[Alexandre Garnier]

Images are binaries displayable by the browser, so loggerhead should show them in :
* revision view with old in red background and new in green background
* annotate view

[Robert Collins (lifeless)]

On Wed, 2009-06-17 at 20:46 +0000, Alexandre Garnier wrote:
> Public bug reported:
>
> Images are binaries displayable by the browser, so loggerhead should show them in :
> * revision view with old in red background and new in green background
> * annotate view

Images are likely a huge risk for content-sniffing attacks. The
content-sniffing behaviour analysis done by google and in discussion on
the IETF-HTTP-wg list should be consulted before considering doing this.

-Rob

[Martin Pool (mbp)]

The risk as I understand it is: someone commits an image into a branch
on Launchpad (for example) that actually contains malicious content
that does a cross-site scripting attack that steals the viewer's
Launchpad credentials.

[Alexandre Garnier (zigarn)]

Maybe add an option to deactivate it in sensible environments.
In my case, loggerhead is used at work for private repository without that kind of risk.

[Martin Pool (mbp)]

Yes an option would make sense to me.

As a future feature, loggerhead could have another option to check the
image is valid (eg by calling out to "jpeginfo -c").

[Michael Hudson-Doyle (mwhudson)]

I think a --trust-content flag would be nice.

[Max Kanat-Alexander (mkanat)]

We don't show them in /annotate/ or /revision/ yet, but they are displayable if you use /raw/ now, on trunk.