GitHub Community
Auditing images uploaded to user-images.githubusercontent.com #28316
Replies: 7 comments 11 replies
|
sensitive infos or images, if the link is already deleted, is hard to be guessed,
it's mentioned at the bottom, so I think, if ever there is that unintentional image upload, you need to contact them as for me, I'm really checking this several times before posting it |
|
People upload images in good faith all the time not realizing that they might be breaching e.g. GDPR requirements. Such images will be visible in issues/pull requests etc. no matter that the URLs are hard to guess. Even if the images references are removed from the contents they are still lying waiting to found by a future security breach. Strictly then, as we have no way to audit the uploaded images, we have no way to ensure that we are GDPR compliant 🤷🏻♂️ |
|
Hi All. Great work @mkyed with that topic. In my opinion the discussion about this is needed. It is not only about sent an issue/PR, but even just about an operation 'drag and drop' a file. I remember how was surprised when discovered that despite Cancel all changes, the file was still uploaded. No notification, no approve message. Only needed to drag and drop the item inside textarea. Typical two ways for this: I'm pretty sure that sooner or later it will be resolved. I created issue about missing note in docs. Best wishes, |
|
It is also problematic that pasting an image into a file in a 'private' repository generates an image URL which is publicly accessible. You can see that it loads when embedded below, despite being pasted into a private repository:
Users likely expect that if they are pasting into a file hosted in a private repository that the pasted image will also be private. |
|
I just discovered this behavior today while trying to import issues from Redmine to github (we want to move from self-hosted stuff to cloud and evaluating various options). I could not believe it works this way... but it does. |
|
The numbers uniquely identify the GitHub account and stays the same even when you change username. For example, if you change your handle from daviewales to davidwhales, then just becomes So any image you upload can be traced back to the account that uploaded the image. |
|
Yesterday 2023-05-22 when I tested image attachment, the urls are of the form and visibility is dependent on repository setting I think. This was changed from the old behavior of fully public urls of the form which was the case as recent as 2023-02-01. As of today 2023-05-23 images seems to now be migrated to the form
Note the lack of file extension. Contrast that with the following format for other attachments EDIT: It seems that while the source link as-written in markdown is changed, the actual serving URL now are either |
|
This one helped me . Thanks for this. |
|
One of my repo is public, however the url of uploaded imgage in Discussions is |
|
They should really implement something to list every uploaded image/file and be able to delete them. |
|
While a feature to better review exiting images would be welcome, note that as of 2023-05-09 #54551 private repo attachements are no longer public so the problem is (somewhat) mitigated. |
|
I accidentally upload an image file into my README using the drag and drop feature and now I can't find and delete it. Will GitHub keep my images in their server forever? I don't get it. |
|
As far as I know, yes. |
|
|
|
would it not be possible to fuzz the UUID and just scrape all the URLs in |
Uh oh!
There was an error while loading. Please reload this page.
Hi all,
Undesirable stuff can easily get uploaded to user-images.githubusercontent.com by mistake when including images writing comments etc. on GitHub. While GitHub Support can help with deleting a specific image there is AFAIK no way to browse through all the images uploaded by our organisation's participants and remove the unwanted ones ourselves.
Am I the only one missing this feature? 😊
/mkyed
All reactions