Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with file-upload
Search options answers only
not deleted
user 53333
File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.
2
votes
Does opening an arbitrary file in a language (such as Python) pose a security risk?
Operating systems generally have a limited number of files they can open at once (specifically, a limited number of file descriptors or fds in Unix-like systems, or HANDLEs in Windows). If you allow p …
- 52.1k
8
votes
Accepted
Is it possible to get XSS through uploading an image via the filename?
Could there exist some site that is vulnerable in this way? Sure, obviously. If the server takes the user-supplied file name and tries to emit it, unescaped, into the document, you'll get XSS. Same as …
- 52.1k
2
votes
Accepted
TOCTOU (Time-of-check to time-of-use) possible without file system access?
Steffen pretty much nailed it in his comment, but to expand on that:
TOCTOU isn't in any way specific to files or file systems; it's a vulnerability that is present any time you have:
Untrusted input …
- 52.1k
1
vote
Accepted
Django File Validation
Python is, in general, pretty secure against arbitrary code execution vulnerabilities in file parsers. The most likely problem you'd face would be if you were invoking an external program to parse or …
- 52.1k
2
votes
Is this CORS exploitable?
This site is vulnerable, if the following assumptions are correct:
example.com has something to attack (data you want to retrieve that only other users can see, or actions you want to take that only …
- 52.1k
2
votes
Is there an encryption mechanism for binary data with expiration for rotating keys?
Ideally, this will be done without first decrypting the file, and then re-encrypting it with the new key.
This part, at least, is easy. Each item, when uploaded, gets a symmetric (e.g. AES) "item en …
- 52.1k
3
votes
Can email services upload files from your computer without your permission/knowledge?
Depends what you mean by "email service", since as a general rule you're using some client to access an email service, and clients have different capabilities and restrictions.
For example, mobile cl …
- 52.1k
1
vote
Accepted
Uploading/writing server files via SSRF?
My question is, using the file:// scheme, can I modify files, or just read them?
A file: URI is just a way to specify a local path. Your question boils down to "using a file path, such as C:\Windows …
- 52.1k
4
votes
Accepted
Malware prevention of data received in a POST endpoint
What's the risk?
For example, someone can send data in a form of html (like above example) and also set it's name as a html file with file extension. If then you request that data, the file is downlo …
- 52.1k