Pixel image call/web bug and CSS/CSRF

[Steven Colley]

Hello all....

I have a question.....

Given the two tags (pixel image call / web bug) bellow (which perform HTTP calls to other domains than the ones of the page that they are running).....

For what concerns CSS and CSRF......

 [b]<img src='https://<domain-1>/...../image.gif?param1=A' />[/b] 

- What is the REAL possibility of having logic embedded into the image GIF which is supposed to be delivered as part of the HTTP response?
- Could the browser end up running malicious code and crash the user's browser?
- any other threat here?

[b]<img src='https://<domain-1>/...../otherResource.xxx?param1=A' />[/b]

- What is the possibility of having logic embedded into the response?
- Could the browser end up running malicious code here?
- any other threat here?

Thank you in advance,

[Saurabh Pillai]

A quick google and I found this link about http://ask-leo.com/can_a_virus_be_transmitted_in_a_picture.html.

I think, Javascript and CSS may contain a virus.

I have not seen many developers worry about this anyway.