Auditing images uploaded to user-images.githubusercontent.com

[mkyed]

Hi all,

Undesirable stuff can easily get uploaded to user-images.githubusercontent.com by mistake when including images writing comments etc. on GitHub. While GitHub Support can help with deleting a specific image there is AFAIK no way to browse through all the images uploaded by our organisation's participants and remove the unwanted ones ourselves.

Am I the only one missing this feature? 😊

/mkyed

[jdevfullstack]

sensitive infos or images, if the link is already deleted, is hard to be guessed,

https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-anonymized-urls

https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-anonymized-urls

it's mentioned at the bottom, so I think, if ever there is that unintentional image upload, you need to contact them

as for me, I'm really checking this several times before posting it

[mkyed]

People upload images in good faith all the time not realizing that they might be breaching e.g. GDPR requirements. Such images will be visible in issues/pull requests etc. no matter that the URLs are hard to guess. Even if the images references are removed from the contents they are still lying waiting to found by a future security breach. Strictly then, as we have no way to audit the uploaded images, we have no way to ensure that we are GDPR compliant 🤷🏻‍♂️
If unreferenced images were pruned out automatically we could scan the contents for image refs. and handle it that way, but I don't think they are(?).

[mbiesiad]

Hi All. Great work @mkyed with that topic. In my opinion the discussion about this is needed.

It is not only about sent an issue/PR, but even just about an operation 'drag and drop' a file. I remember how was surprised when discovered that despite Cancel all changes, the file was still uploaded. No notification, no approve message. Only needed to drag and drop the item inside textarea.

Typical two ways for this:
first one - if I drag & drop (so upload file process) I can edit or delete/remove this (mistake case) later
second one - if I wanted to upload something and I will not to have an opportunity to delete it in easy way, I can see a confirmation window ("Are you sure?")

I'm pretty sure that sooner or later it will be resolved. I created issue about missing note in docs. Best wishes,

[daviewales]

It is also problematic that pasting an image into a file in a 'private' repository generates an image URL which is publicly accessible.
For example, the following URL was generated when I pasted a screenshot of the GitHub logo into a README in a private repository.

https://user-images.githubusercontent.com/2499066/197930666-7bf6de17-29ad-4d16-8568-17f871edbfd7.png

You can see that it loads when embedded below, despite being pasted into a private repository:

Users likely expect that if they are pasting into a file hosted in a private repository that the pasted image will also be private.
But this is clearly not the case!

[macmacy]

I just discovered this behavior today while trying to import issues from Redmine to github (we want to move from self-hosted stuff to cloud and evaluating various options). I could not believe it works this way... but it does.
I started to search on the subject, which led me here. I simply cannot understand how github crew can let this issue live. For me this is tremendous security flaw. And: no, "anonymized URLs" is not the answer. It's excuse. I'm really glad I found it before we moved here.

[expikr]

https://avatars.githubusercontent.com/u/2499066

https://api.github.com/users/daviewales

The numbers uniquely identify the GitHub account and stays the same even when you change username.

For example, if you change your handle from daviewales to davidwhales, then

2499066+daviewales@users.noreply.github.com

just becomes

2499066+davidwhales@users.noreply.github.com

So any image you upload can be traced back to the account that uploaded the image.

[expikr]

Yesterday 2023-05-22 when I tested image attachment, the urls are of the form

https://private-user-images.githubusercontent.com/<user-id-number>/<random-filename-guid>.png?jwt=<some super long token>

and visibility is dependent on repository setting I think. This was changed from the old behavior of fully public urls of the form

https://user-images.githubusercontent.com/<user-id-number>/<random-filename-guid>.png

which was the case as recent as 2023-02-01.

As of today 2023-05-23 images seems to now be migrated to the form

https://github.com/<accountname>/<reponame>/assets/<user-id-number>/<random-filename-guid>

Note the lack of file extension. Contrast that with the following format for other attachments

https://github.com/<accountname>/<reponame>/files/<somecounter>/<original-upload-filename-with-ext>

sometext.txt

EDIT: It seems that while the source link as-written in markdown is changed, the actual serving URL now are either private-user-images.githubusercontent.com or user-images.githubusercontent.com depending on the repository visibility.

[pavankv241]

This one helped me . Thanks for this.

[mrmign]

One of my repo is public, however the url of uploaded imgage in Discussions is private-user-images.githubusercontent.com, i don't know how that happened.

[LoneDev6]

They should really implement something to list every uploaded image/file and be able to delete them.
Right now it's impossible to delete pasted images into issue reports and similar places.

[JMBurley]

While a feature to better review exiting images would be welcome, note that as of 2023-05-09 #54551 private repo attachements are no longer public so the problem is (somewhat) mitigated.

[wentallout]

I accidentally upload an image file into my README using the drag and drop feature and now I can't find and delete it. Will GitHub keep my images in their server forever? I don't get it.

[LoneDev6]

As far as I know, yes.
You can try contacting them, they might delete it manually.