4

I have an "index.html" (or .php - it makes no difference) file in the root / of my hosting space. That "index.html" file has this line of code in it:

<link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyBpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEzNDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNSBXaW5kb3dzIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjFGNTRDMzg0OEY1MzExRTQ4RkZGOTFCQzU3QkEzQTFBIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjFGNTRDMzg1OEY1MzExRTQ4RkZGOTFCQzU3QkEzQTFBIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MUY1NEMzODI4RjUzMTFFNDhGRkY5MUJDNTdCQTNBMUEiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MUY1NEMzODM4RjUzMTFFNDhGRkY5MUJDNTdCQTNBMUEiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz5w10C9AAAARElEQVR42mJgIBEwAvH///+hHEZG0jSgSODQzEK8UghgosgPJDuJIk/jMoVkP7AQaTCVbCDG09SLB1x2kuwkkgFAgAEA2noPMd6y8cUAAAAASUVORK5CYII="/>

When I try to access my domain name, I get a customized internal server error message "Internal server error, please contact ..". If I remove that line of code, it works.

If however, I create a folder called "test", put the "index.html" file inside it and access the file as "mydomain.com/test" everything works fine.

Any ideas? (i will try a js replacement however, this goes to the general point, of why does the error pop up?)

Improve this question
6
  • Oh. Good one!! It would be interesting to hear what people have to say on this.
    – closetnoc
    Commented Apr 17, 2015 at 5:11
  • Some kind of mod_security rule?! Does it "work" if you use the same data URI in an img element in the body of the page? How "customized" is this error? "please contact .." - have you tried? Or is that just a generic message?
    – MrWhite
    Commented Apr 17, 2015 at 8:36
  • I tried changing the filename from index.html to index.php. But I have the same error.
    – anoix
    Commented Apr 17, 2015 at 9:02
  • 1
    Have you checked your error log?
    – MrWhite
    Commented Apr 17, 2015 at 9:37
  • It works fine for me in the webroot folder for a domain on Apache and I've tried it with 3 different hosting environments/providers, I imagine you'll need to contact your hosting provider if this bothers you. It also works using the <img src="" /> method.
    – richhallstoke
    Commented May 7, 2015 at 14:37

2 Answers 2

Reset to default
2

This sounds like an issue that is specific to your hosting provider. The likely explanation is that they have a check in place to look for malware on the home page of your site. Base64 encoded JavaScript is often used to obfuscate JavaScript inserted by a hack. Their malware scanner triggers when it detects any Base64 encoded data.

To resolve the issue you would need to contact your web host. They may be able to disable this check for your site.

Improve this answer
1
  • there is something happening inside the php inbuilt function $base64_decode() that wont let you decode code inside base64 strings, i assume for seniority reasons. i found that if you encode anything that resembles sql strings you get the same internal server error.
    – Jay Dee
    Commented Oct 3 at 0:19
0

Using the following source code in a file name index.html in the root folder of a published website with a domain ending .com:

<html><head>
  <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyBpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEzNDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNSBXaW5kb3dzIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjFGNTRDMzg0OEY1MzExRTQ4RkZGOTFCQzU3QkEzQTFBIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjFGNTRDMzg1OEY1MzExRTQ4RkZGOTFCQzU3QkEzQTFBIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MUY1NEMzODI4RjUzMTFFNDhGRkY5MUJDNTdCQTNBMUEiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MUY1NEMzODM4RjUzMTFFNDhGRkY5MUJDNTdCQTNBMUEiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz5w10C9AAAARElEQVR42mJgIBEwAvH///+hHEZG0jSgSODQzEK8UghgosgPJDuJIk/jMoVkP7AQaTCVbCDG09SLB1x2kuwkkgFAgAEA2noPMd6y8cUAAAAASUVORK5CYII="/>
</head><body>
  <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyBpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEzNDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNSBXaW5kb3dzIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjFGNTRDMzg0OEY1MzExRTQ4RkZGOTFCQzU3QkEzQTFBIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjFGNTRDMzg1OEY1MzExRTQ4RkZGOTFCQzU3QkEzQTFBIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MUY1NEMzODI4RjUzMTFFNDhGRkY5MUJDNTdCQTNBMUEiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MUY1NEMzODM4RjUzMTFFNDhGRkY5MUJDNTdCQTNBMUEiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz5w10C9AAAARElEQVR42mJgIBEwAvH///+hHEZG0jSgSODQzEK8UghgosgPJDuJIk/jMoVkP7AQaTCVbCDG09SLB1x2kuwkkgFAgAEA2noPMd6y8cUAAAAASUVORK5CYII="/>
</body></html>

Here's a screenshot of the result in Firefox (v38.0.1), showing your icon working from base64 encoded inline data both as a favicon in the browser tab and also as a static image within the body section of the web page.

Screenshot of icon working from base64 encoded inline data

As mentioned before in a comment I've tried this file with 3 different hosting environments/providers with consistent results and have been unable to reproduce the issue you had described where an Internal Server Error is generated by Apache.

Tested/known working configurations:

  • 2.6.18-164.el5, Apache v2.2.3, PHP v5.3.4-dev
  • 3.2.61-grsec-modsign, Apache v2.2.29, PHP v5.4.37
  • 2.6.18-471.3.1.el5.lve0.8.72, Apache v2.4.12, PHP v5.4.40
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.