Skip to content
This repository has been archived by the owner on May 10, 2018. It is now read-only.

Disallow arbitrary file upload from js #12

Open
uuf6429 opened this issue Apr 23, 2017 · 0 comments
Open

Disallow arbitrary file upload from js #12

uuf6429 opened this issue Apr 23, 2017 · 0 comments

Comments

@uuf6429
Copy link
Owner

uuf6429 commented Apr 23, 2017

In some cases we need to trigger a file upload from the page JS.

The JS running inside the browser is not usually allowed to perform this action (for obvious security reasons).

In our case, we need this functionality without opening a huge security hole. The solution is to have a whitelist of files that can be uploaded:

-> setValue(element, value)
-- allowedFiles = [value]
-- <- setFileValue(value)
-- if value in allowedFiles ...

Issue happens here: https://github.com/uuf6429/MinkElectronDriver/blob/master/src/Server/Server.js#L267

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant