头像上传未过滤

<script>alert("xss")</script>保存为图片上传，报错

Traceback (most recent call last):
File "/usr/lib/python2.6/site-packages/tornado/web.py", line 988, in _execute
getattr(self, self.request.method.lower())(*args, **kwargs)
File "/usr/lib/python2.6/site-packages/tornado/web.py", line 1739, in wrapper
return method(self, *args, **kwargs)
File "/www/v2ex/galaxy/handlers/web/settings.py", line 364, in post
avatar73 = self.rescale(avatar, 73, 73)
File "/www/v2ex/galaxy/handlers/__init__.py", line 395, in rescale
img = pil.open(input_file)
File "/usr/lib64/python2.6/site-packages/PIL/Image.py", line 1980, in open
raise IOError("cannot identify image file")
IOError: cannot identify image file