search

imagekit-developer / imagekit-javascript

Javascript SDK for using ImageKit.io
https://imagekit.io
77 stars 26 forks source link

Potential security problem #10

Closed chaoticvibe closed 4 years ago

chaoticvibe commented 4 years ago

https://docs.imagekit.io/api-reference/upload-file-api/client-side-file-upload "Client-side upload" I found a possible problem of security, that maybe can put in risk users images. If the client-side (uploader) know users file name, because the client side can replace the file if set useUniqueFileName to false, right? So, for example, if the client-side know the file name from the profile pic from a user, the client-side can replace the file, changing a profile pic from another user, just with a little of "malicious intention" .... It was what i understand.... Please help me with this question.https://docs.imagekit.io/api-reference/upload-file-api/client-side-file-upload

imagekitio commented 4 years ago

@makveli, it is not possible because when using client-side file upload token parameter is required. And a token can only be used once.

chaoticvibe commented 4 years ago

@makveli, it is not possible because when using client-side file upload token parameter is required. And a token can only be used once.

Sorry i'm very confuse now, the token used in client side allow only one unique upload? Ok, but what about file name conflict security, remember the client side can choice the file name? ... Some way to impossiblity client-side select the file name? With this in mind, is impossible conflicts or rewrites another users images? Thank very much by reply.

//Example Like with s3 upload without server, generating signature, the file name can be controlled in the server side, that generate the signature to allow client-side (browser) upload "serverless", so turn impossible a file conflicts. Please be more clare. Thanks :)