Base solution for your next web application
Open Closed

GetUploadedObject Security #6159

User avatar
0
feloff created

There seems to be no validation for downloading binary objects using this method (used for downloading chat attachments). Is leaving all binary objects free for download not too big a hole in the security?

Markdown is supported
Copy & paste or drag & drop images (max 30 MB per image)
Go to accepted answer
4 Answer(s)
  • User Avatar
    0
    ismcagdas created
    Support Team

    Hi @feloff

    Could you write the name of the class (Controller) and it's method name ?

    Markdown is supported
    Copy & paste or drag & drop images (max 30 MB per image)
  • User Avatar
    0
    feloff created

    Hi, In the ChatController (Web.Host Project) controller. Method: GetUploadedObject (Angular + Core project version 6.2.1) Kind regards,

    Markdown is supported
    Copy & paste or drag & drop images (max 30 MB per image)
  • User Avatar
    0
    ryancyq created
    Support Team

    thanks for reporting.

    Have created an issue on this.

    https://github.com/aspnetzero/aspnet-zero-core/issues/2035

    Markdown is supported
    Copy & paste or drag & drop images (max 30 MB per image)
  • User Avatar
    0
    ryancyq created
    Support Team

    The fix wil be released with ANZ v6.5

    Markdown is supported
    Copy & paste or drag & drop images (max 30 MB per image)
Assignee
No one
Labels
None yet