title: Security issues in accepting image uploads
body: <p>What are the major security issues to consider when accepting image uploads, beyond the normal stuff for all HTTP uploads?</p>
  
  <p>I'm accepting image uploads, and then showing those images to other users.</p>
  
  <p>How should I verify, for example, that the uploaded image is actually a valid image file? Are there any known vulnerabilities in viewers that are exploitable by malformed image files for which I should be concerned about accidentally passing along exploits? (Quickly googling seems to show that there once was in IE5/6.)</p>
  
  <p>Should I strip all image metadata to help users prevent unintentional information disclosures? Or are there some things that are safe and necessary or useful to allow?</p>
  
  <p>Are there any arcane features of common image formats that could be security vulnerabilities?</p>
  
  <p>Are there any libraries that deal with these issues? (And/or with other issues like converting progressive JPEGs to normal JPEGs, downsampling to standardize sizes, optimizing PNGs, etc.)</p>