guanshuicheng / invoice

Collaboration with wangxupeng(https://github.com/wangxupeng)
MIT License
1.83k stars 455 forks source link

Issue regarding uploading file filtering #60

Open nevercodecorrect opened 11 months ago

nevercodecorrect commented 11 months ago

Hello, While trying the tool, I find that the uploading file functionality relies on using the user-provided filename extension which could be a security issue as described in CWE-646: Reliance on File Name or Extension of Externally-Supplied File. Attacker could obfuscate the file name extension and drop malicious code on the server for the further attack. Thanks for reading.