Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A file that’s both an acceptable HTML page and a JPEG (2012)

lcamtuf.coredump.cx

Post reply on HN
Print view View original

51–60 of 72 posts

Re: A file that’s both an acceptable HTML page and a JPEG (2012)

#51

Post by boomlinde »

tialaramex wrote: post #47
boomlinde wrote: post #38

Earlier quoted context omitted.

DEFLATE, which is used by PNG, is a general purpose LZ77-like compression algorithm suitable for all kinds of repetitive data.

PNG filters each horizontal line of the image data before running it through Deflate, with a pre-processing step. Each of the possible filters is very simple, but the difference between a great PNG exporter, a mediocre one, and a trash fire is the use of a heuristic to decide which of the pre-processing filters should be applied to each line of output. libpng, the free implementation, includes a heuristic that does a…

> PNG filters each horizontal line of the image data before running it through Deflate, with a pre-processing step.

Yes, as a means of making the data fed into the compressor repetitive enough to benefit from the compression algorithm.

> So, no, a general purpose compression algorithm isn't very good for image data on its own.

That's not what I said.

Re: A file that’s both an acceptable HTML page and a JPEG (2012)

#52

Post by kenbellows »

3chelon wrote: post #50

The first thing to cross my mind when I saw this was XSS vulnerabilities. Presumably there's nothing to stop this page running JS?

Assuming you can include JS in the file, I imagine it would only run if the file was being parsed as HTML at the moment, not when parsed as a JPEG. That's the main point here: this file can be interpreted in two ways, but the data in it is treated very differently and has different effects depending on the way it's currently interpreted.

Re: A file that’s both an acceptable HTML page and a JPEG (2012)

#53

Post by wimagguc »

Nice one! So is the trick that:

1. JPEG allows text comments

2. Browsers don't enforce correct HTML (alternatively, is "����JFIF,,��r" correct HTML?)

3. And exif tools mostly work based on header & statistical analysis?

Or am I completely wrong here?

Re: A file that’s both an acceptable HTML page and a JPEG (2012)

#55

Post by opencl »

peterburkimsher wrote: post #43

It's a pity that phones recompress the JPG when doing Save To Camera Roll. I'd like to build a system for distributing mini-apps as images, bypassing the App Store. A JavaScript bookmarklet could be used to provide a basic "bootloader" that provides an "upload image" button. Then a binary representation of the HTML could be loaded from the image data. The problem I had was lossy recompression - colours bleed across e…

My phone left the JPG entirely intact when downloading it. I suppose you're talking about iOS devices?

Re: A file that’s both an acceptable HTML page and a JPEG (2012)

#56

Post by londons_explore »

duckerude wrote: post #49
amelius wrote: post #40

But what does the Unix "file" command say?

$ curl -s http://lcamtuf.coredump.cx/squirrel/ | file - /dev/stdin: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: " body { visibility: hidden; } .n { visibility: visible; position: absolute; ", baseline, precision 8, 1000x667, frames 3 file(1) version 5.32-2ubuntu0.1.

file knows...

Re: A file that’s both an acceptable HTML page and a JPEG (2012)

#58

Post by EMRZ »

skrebbel wrote: post #39
EMRZ wrote: post #30

The last week i found this [1] thread by Notch. He is working in an entry to js13k [2] (a game jam about html5 games restricted to 13 KBs). He bundled the whole source code and binary data used in the game/tech demo to use the in browser image decompression, avoiding to write a custom (de)compression code, saving KBs this way. Then he just eval() the needed parts for each thing. I found this extremely clever, game ja…

Just so other readers don't mistake this for what it is: this is a pretty common technique in JS sizecoding and it's by no means Notch's invention (and he doesn't claim that it is).

When i read that i found it amazing and very clever, i honestly never thought if it was or not Notch's invention.

I am not really into javascript/frontend development, but following js13k on twitter showed me a lot of things you can do to gain KBs on the client side.

However, is this that common?

Thanks for the info btw.

Re: A file that’s both an acceptable HTML page and a JPEG (2012)

#59

Post by Drup »

13of40 wrote: post #28
notadog wrote: post #16

EDIT: I realize that the subject of this thread is not a polygot, but I'm leaving this comment up in case it interests someone. :/ If anyone's interested in what these are called, they are called polygots. > In computing, a polyglot is a computer program or script written in a valid form of multiple programming languages, which performs the same operations or output independent of the programming language used to com…

I always thought it was called a chimera.

So, if I remember correctly Ange Albertini's nomenclature, chimeras are particular types of polyglots where a single data is disguised as different file formats. For example, consider a file that is both a JPEG of a picture and a PDF which contains the same picture, and the data of the picture is present only once in the file.
Post reply on HN