title: Validating the legitimacy of images (Malware / embedded XSS detection)
body: <p>Our cloud system was recently subjected to a pen test. One of the flags raised in the report regarded an upload form which 'allowed uploads of arbitrary data'. Even once restricted to images (detected largely by extension and PHPs built in mime detection), they are still concerned about 1) hidden malware or 2) XSS attacks embedded in to the images themselves.</p>
  
  <p>How is it possible to defend against these vectors?</p>
  
  <p>Edit: the suggested duplicate is not applicable because -</p>
  
  <p>An image with embedded XSS would still validate with usual checks (it could be hidden in the comment section of a gif file, for instance). Furthermore, checking the image size is already one of the checks done, but research will prove it is not reliable for such use.</p>