Closed maus- closed 7 years ago
You really should scope what folder that contains data to be uploaded to mitigate this.
Good point Although I think upload.py should be taken as an example. Nevertheless it should be pointed out at least in the comments of the function.
You can arbitrarily upload any file on the host of the slackbot. IE !upload ../../../../etc/passwd or get it to drop sensitive config files.