News for hackers. Stuff that matters.

A comment on If your code accepts URIs as input, filter out “file://”.

Re:If your code accepts URIs as input, filter out “file://” by phibit on Monday September 12, 2016 @07:22PM (#12484461)
Another fun one that's becoming more common with cloud hosted services: access to internal metadata services that issue credentials.

Blocking file:// doesn't prevent access from > http://169.254.169.254/latest/meta-data/iam/security-credent....

[ Parent | on HN ]

There are no comments on this comment yet.