Incomprehensible image upload without format?

Question

Graphic arts

The user uploaded an image to the site, the browser visually displays it, although this image is without a format.


When you try to open this image in a new window, this thing appears:


This is how the downloaded image already looks:


Who can explain what it is and is it worth it to be afraid of hacking the site? And how to get rid of such downloads?

Answer 1

This happens when the HTTP response does not specify a Content-Type with an image format.
How the image is displayed is controlled by Content-Disposition .

Answer 2

1. Be afraid. It's like an executable file.
2. Check the format when loading by setting the list of available ones in the config.

Answer 3

Perhaps this is what the article about Android hacking using PNG is talking about.
A regular PNG image could be completely compromised...