Comment by echoangle
19 hours ago
How do you handle file uploads then? Isn’t that handled by the same process writing the uploaded files to disk?
19 hours ago
How do you handle file uploads then? Isn’t that handled by the same process writing the uploaded files to disk?
You could write them into a database instead. Or you make an exception for them.
>You could write them into a database instead.
"How to make your site cost unlimited money and have terrible performance". People did this in the Web 1.0 days on occasion and it leads to all kinds of problems for any site with any kind of traffic.
>Or you make an exception for them.
Useless. All you need to do at that point is chain a priv-esc to your existing exploit and you get root.