Hacker News new | ask | show | jobs
by stevekemp 2918 days ago
Is there a way to provide private feedback? There's no email address I could find on the site, or your profile here.
1 comments

Reported via email, and now fixed.

Requesting URLs such as `file:///etc/passwd` would result in viewing the contents of arbitrary files upon the host. A common security problem I've discussed in the past:

https://blog.steve.fi/if_your_code_accepts_uris_as_input__.h...

Thanks again - all fixed. Code runs on an aws lambda function, but always appreciate finds like these.