After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I don't have any file upload handling functions can user write and execute malware code into file and execute it?

  • Please clarify the question. Are you talking about processing a file-type <input> on the client (that is, in the web browser), or on the server (after the HTML <form> is submitted)? What kind of processing are you doing with the file? Presumably, if you have a way for the user to input a file, you are doing something with it; what that thing is determines what your security risks are. – CBHacking Jan 15 at 22:27
  • @CBHacking Yea, <input type="file" ... I am talking about file upload, but not to the server. But when browser first sees uploaded file. For example can I encode console.log('it worked'); to the file and execute it when uploading to browser? – KoboldMines Jan 16 at 8:40
  • You don't "upload" anything to a browser. I'm not sure if this is a terminology confusion or something deeper. Processing a file using client side script in a browser is akin to opening a .docx file in Word and calling that "uploading" doesn't make sense, it doesn't travel over any network or to any server. In any case, JavaScript can see the contents of a file input field using the FileReader class, but you have to write script to do that (see stackoverflow.com/questions/5802580/…) – CBHacking Jan 19 at 5:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.