News for hackers. Stuff that matters.

A comment on Zero-day in jQuery plugin sample code exploited for at least three years. Parent comment

Re:Zero-day in jQuery plugin sample code exploited for at le... by DCoder on Monday October 22, 2018 @12:01AM (#18272091)
Also known as "use a whitelist instead of a blacklist".
[ Parent | on HN ]
Re:Zero-day in jQuery plugin sample code exploited for at le... by blueimp on Monday October 22, 2018 @10:41AM (#18275009)
Although I agree with you in a general sense, in this case there was no blacklist mistakenly used.

If the server is configured to serve uploaded files securely, it is feasible to allow all file types for upload (e.g. think of Amazon S3 or Google Cloud Storage).

However since there is no way to ensure that the server security settings to securely handle uploaded files are applied, limiting file uploads with a whitelist minimizes the attack vector sufficiently.

[ Parent | on HN ]