title: Sanitize image content and remove embedded Javascript
body: <p>For an image upload API that we’re building, is there any guidance on checking/sanitising for malicious content ?</p>
  <p>I’ve seen examples in the internet where we can add JavaScript inside an image and upload it to any file upload API. If we were to render the image as-is using  element elsewhere, that embedded JS code is executed by the browser.</p>
  <p>While searching for mitigation advice, I came across this <a href="https://owasp.deteact.com/cheat/cheatsheets/Protect_FileUpload_Against_Malicious_File.html" rel="nofollow noreferrer">link</a> in OWASP docs. Their recommendation is to rewrite images using Apache Commons Imaging library but I’m not sure if it’s actively maintained (last update in 2020)</p>
  <p>Is there a better way of detecting embedded JS in images (or) some safe way of rendering these images in browser to mitigate against Stored XSS attacks ?</p>
  <p>Appreciate any help on this.</p>