New answers tagged

7

Could there exist some site that is vulnerable in this way? Sure, obviously. If the server takes the user-supplied file name and tries to emit it, unescaped, into the document, you'll get XSS. Same as any other user-supplied data. Is the particular site you're looking at, or indeed any site on the whole Internet right now, vulnerable? We have no way to know ...


1

You handle the upload with POST requests to a PHP script which checks the file extension and renames the file You should check the mime type. PHP have mime_content_type function for that. Even if it's possible to fool the mime header and have some code on the metadata of the file, this raises the bar for exploiting your system. If I understand correctly, ...


0

Regarding the location in the file system hierarchy, there is no difference between /videos, and /var/www/html/site/videos, or the like. The issue is what permissions, i.e. the executable bit, the directory and files have, (which you mentioned), and also the user to which they are assigned, e.g., www-admin, nginx, etc. Also, file uploads should be limited ...


0

Let people store anything they want, rename the file to something random (SHA1 of random long number is enough), move them off the server root, and record the new name and original name on a database, taking care of sanitizing the filename. List files using the original names on the filename (again take care with sanitization), and use PHP fpassthru or ...


Top 50 recent answers are included