Adding in some more information.... and a server side solution in C#.

A StackOverflow post also outlining the issue with no solution: http://stackoverflow.com/questions/6708747/firefox-allows-desktop-image-files-to-be-dragged-in-to-ckeditor


Here's my C# sample code that uses the free HTML Agility Pack to parse through the data:

public static string SanitizeMessageInput(string message)
{
   HtmlDocument doc = new HtmlDocument();
   doc.LoadHtml(message);

   if (doc.DocumentNode != null)
   {
      HtmlNodeCollection imageDataNodes = doc.DocumentNode.SelectNodes("//img[contains(@src,'data:')]");
      // strip out BASE64 encoded images in the message
      if (imageDataNodes != null)
      {
         foreach (HtmlNode node in imageDataNodes.ToList())
         {
            if (node.Attributes["src"].Value.IndexOf("base64,") >= 0)
            {
               node.ParentNode.ReplaceChild(HtmlNode.CreateNode("<div class=\"tinyerror\">Inline Image removed from message, don't drag images into the message editor!</div>"), node);
            }
         }
      }
      // you can do more processing here to also strip out script tags and the like
      return doc.DocumentNode.OuterHtml;
   }
   else
   {
      return message;
   }
}

Solution works really well, given there doesn't seem to be an easy way to disable CKEditors handling of the base64 encoded data. It would be much nicer to handle this client side as any dragged image gets posted along in the message causing a huge postback, especially on large images. If I have missed something and there is a way to disable this in CKEditor, please contribute to the post!