Giters

minimaxir / big-list-of-naughty-strings

The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

add null byte

jimmywarting opened this issue · comments

commented

say that you have two files on the disc

  • secret.json
  • profile.jpg

the server allows you to read the content of any file ending with with jpg, so it is automatically suffixed with +".jpg"

readFile(path + ".jpg")

but if you could trick it maybe you can get away with reading secret.json if you say that you want to read secret.json\0whatever_not_included

commented

In what environment does that happen ?