5 ms·
No. You can get the remote server's /etc/passwd in some cases. Most OS's would block a file that obvious from a non-privileged app but maybe /tmp/session.32eg3g
by singlow 9y ago
No. You can get the remote server's /etc/passwd in some cases. Most OS's would block a file that obvious from a non-privileged app but maybe /tmp/session.32eg3g3.txt is readable. There are sensitive local files that are readable by your web app so you must take precautions. This is in fact a common security hole caused by careless developers.
- lawnchair_larry 9y agoWith a file:// URI? No you can't. That isn't how that works. You're confusing this with remote file disclosure attacks, which are totally different.