Zero-day in jQuery plugin sample code exploited for at least three years

Re:Zero-day in jQuery plugin sample code exploited for at le... by pdkl95 on Sunday October 21, 2018 @08:26PM (#18271224)

> Never allow all file types for upload by default, even if it is secure in your configuration

The general form - never use default-allow - should be used in most situations where set of possible inputs cannot be exhaustively enumerated. In most situations, you cannot enumerate badness[1]. Instead of trying to define valid input by specifying it's inverse, it's far simpler (and safer) to use default-deny and specify valid input directly.

[1] http://www.ranum.com/security/computer_security/editorials/d...

[ Parent | on HN ]

Re:Zero-day in jQuery plugin sample code exploited for at le... by DCoder on Monday October 22, 2018 @12:01AM (#18272091)

Also known as "use a whitelist instead of a blacklist".

[ Parent | on HN ]

Re:Zero-day in jQuery plugin sample code exploited for at le... by blueimp on Monday October 22, 2018 @10:41AM (#18275009)

Although I agree with you in a general sense, in this case there was no blacklist mistakenly used.

If the server is configured to serve uploaded files securely, it is feasible to allow all file types for upload (e.g. think of Amazon S3 or Google Cloud Storage).

However since there is no way to ensure that the server security settings to securely handle uploaded files are applied, limiting file uploads with a whitelist minimizes the attack vector sufficiently.

[ Parent | on HN ]