3 ms·
What? No. mod_userdir is not dangerous. The resulting URLs are not dangerous. Having multiple unrelated unvetted outside users with the ability to make your se
by torstenvl 7y ago
What? No. mod_userdir is not dangerous. The resulting URLs are not dangerous.
Having multiple unrelated unvetted outside users with the ability to make your server serve arbitrary JavaScript is dangerous. The route you take to get there is kind of beside the point.
If anything, mod_userdir is helpful in that it's obvious when content is under the control of a different user. Perhaps browsers should treat x.com/~x/ as a different server from x.com/~y/ for XSS purposes.