Couple of links about the potential problems which are mostly CSRF and DOS

• http://security.stackexchange.com/questions/36447/img-tag-vulnerability
• http://cms.about.com/od/maintain-your-cms-website/a/Images-In-Html-Security.htm

Since the images are on the server itself (within the git) this might be fine but we would have to make sure the image is an image first (try loading it with pillow?).

This is fixed: http://209.132.184.222/progit/blob/master/screenshots/overview_commit.png

What we did is checking if the file loads fine in python-pillow:

• http://209.132.184.222/progit/a1aa0b735d616f316d018a74e94069121c105032

If so, then we display it as such:

• http://209.132.184.222/progit/cabeba9fe1dc3a7df55774064e6aed027fe568d2

And we add something in the logs if we failed to load the file:

• http://209.132.184.222/progit/1f3f7b668c6dca081b501850b4875354e254a805