4 ms·

Hi, the error message is a bit confusing - certain file type extensions may cause the user profile page not to load. Disallowing specific extensions in the user

• city41 5y ago
  The analogy to SQL injection is a user's input (what they chose their username to be) is directly influencing how the system works.
• arianvanp 5y ago
  That you change the Content-Type of a page based on the URL is quite a vulnerability on itself no? I don't think browsers infer meaning about file types based on the URL. The Content-Type is always what is being used. If you have backend side code that maps URLs Content-Type header mime types. Don't. Instead simply always return text/html for user profiles. Then the extension shouldn't matter.
• lol768 5y ago
  > certain file type extensions may cause the user profile page not to load There is no reason for this. They should always hit the same controller and be served as text/html. Why would the username ever influence this? If that breaks an existing page then you either shouldn't have allowed the username to be created with the same name as an existing page (exactly what GitHub does) or shouldn't have created a page with the same name as a username [depending on which came first!] - or better yet, had them in a separate namespace so they cannot conflict in the first place.