One file that is both JPEG and HTML
Summary
Michal Zalewski constructs a polyglot file that image viewers accept as JPEG and browsers as HTML. The demonstration is valid JPEG and executable HTML. Browsers and image programs interpret the same bytes differently.
Ideas
- File formats recognise content based on different starting points and rules.
- Tolerant parsers ignore data that another parser interprets.
- One byte sequence can contain several formally valid structures.
- Checking content by file extension alone remains unreliable.
Insights
- Differences between parsers create security boundaries with unexpected gaps.
- Lenient error handling increases compatibility and attack surface at the same time.
- Validation must use the same parser as later processing.
Facts
- The project comes from Michal Zalewski.
Recommendations
- Determine file types from content and context of use.
- Serve uploads with safe Content-Type and download headers.
References
Links to the original source and the Web Archive open in a new tab.