#27358: Add a system check for FileField upload_to starting with a slash
-------------------------------------+-------------------------------------
Reporter: Tim Graham | Owner: Henry
Type: | Dang
Cleanup/optimization | Status: assigned
Component: Core (System | Version: 1.10
checks) |
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by François Freitag):
Would it be interesting to check for known potentially dangerous filenames
[#point1 (1)], such as {{{../index.html}}}?
[=#point1 (1)]
https://www.owasp.org/index.php/Unrestricted_File_Upload#Other_Interesting_Test_Cases
--
Ticket URL: <https://code.djangoproject.com/ticket/27358#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.ad895f33aac06cba312822f47c3ca43e%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
