News for hackers. Stuff that matters.

A comment on Zero-day in jQuery plugin sample code exploited for at least three years.

Re:Zero-day in jQuery plugin sample code exploited for at le... by londons_explore on Monday October 22, 2018 @06:00AM (#18273397)
Haven't seen this sample code, but in general letting your users set the filename of anything on your server is a bad plan.

If the upload script just generated a random filename (046359905445.bin), and then stored the mime type, users filename, other metadata, etc. in a database, that would be a much better design.

[ Parent | on HN ]
Re:Zero-day in jQuery plugin sample code exploited for at le... by blueimp on Monday October 22, 2018 @11:06AM (#18275214)
I agree with you that this would be the safer route. For a production file upload service, file uploads should ideally stored in a specialized blob store, e.g. Amazon S3 or Google Cloud Storage.

However the PHP code was written as easy-to-use sample code and I did not want to introduce a database as dependency and keeping the sanitized filename plus extension keeps the meta information intact.

If I had provided better information about how to securely configure the Webserver to allow all file types for upload, using the original - but sanitized - filenames would not be an issue.

[ Parent | on HN ]