Mario Limonciello 76b54e7de4 Sanitize uploaded filenames in upload example to prevent path traversal ...

The upload example wrote each uploaded file using the filename supplied
verbatim in the multipart Content-Disposition header. A client could set
that filename to an absolute path or one containing "../" components and
cause the server to create or overwrite files outside the working
directory.

Reduce each client-supplied filename to its base name and reject the
request with 400 Bad Request if the result is empty, ".", "..", or
still contains a path separator (including colon for Windows drive
letters).

2026-07-27 10:56:49 -05:00

2.4 KiB

Raw Blame History

View Raw