Security issues with base64 encoded images

Question

I have an API that accepts base64 encoded image data and will have to decode the data, save the image file, and then create a sketch from this image.

I am concerned that malicious code may be executed if I do not properly check the contents of the POST payload before trying to create a thumbnail.

The main workflow that I still have is below. Is checking enough that I don’t have to worry about security? I guess I'm worried that someone is encoding something bad, and then when one of the image features below is called, the Internet explodes.

<?php

$decodedImage = base64_decode($_POST["canvas"]);
if ($decodedImage === false) {
    // Error out
}

$imageSizeValidation = getimagesizefromstring($decodedImage);
if ($imageSizeValidation[0] < 1 || $imageSizeValidation[1] < 1 || !$imageSizeValidation['mime']) {
    // Error out
}

$tempFilePath = "/tmp/" . microtime(true) . "-canvas-web.jpg";
file_put_contents($tempFilePath, $decodedImage);

$originalWidth = $imageSizeValidation[0];
$originalHeight = $imageSizeValidation[1];
$newWidth = 49;
$newHeight = 49;

$scaleWidth = $newWidth / $originalWidth;
$scaleHeight = $newHeight / $originalHeight;
$scale = min($scaleWidth, $scaleHeight);

$width = (int)($originalWidth * $scale);
$height = (int)($originalHeight * $scale);

$xpos = (int)(($newWidth - $width) / 2);
$ypos = (int)(($newHeight - $height) / 2);

$oldImage = imagecreatefromjpeg($tempFilePath);
$newImage = imagecreatetruecolor($width, $height);
$background = imagecolorallocate($oldImage, 255, 255, 255);

imagefilledrectangle($newImage, 0, 0, $width, $height, $background);

imagecopyresampled($newImage, $oldImage, $xpos, $ypos, 0, 0, $width, $height, $originalWidth, $originalHeight);
imagedestroy($oldImage);

imagejpeg($newImage, "/path/to/new.jpg", 90);

imagedestroy($newImage);

Answer 1

, , , :

, , , PHP, Ruby .. EG: :

<?php phpinfo();

imagecreatefromstring(), temp imagejpeg().

, , PHP . getimagesize(). , , .

, , - microtime(), .

, : https://www.owasp.org/index.php/Unrestricted_File_Upload

, SO , : base64

, , , : http://www.apress.com/9781430233183