20 ms·
"Not through a web application vulnerability it can't (there is no application code to break!)." eg. metadata in images can contain executable code
by evandrix 11y ago
"Not through a web application vulnerability it can't (there is no application code to break!)."
eg. metadata in images can contain executable code
- geofft 11y agoNot intentionally-executable code, and unintentionally-executable code (i.e. exploits in image renderers) would affect the client, not the server, which isn't the direction we're concerned about. If the server transcodes images, then yes, it should do the transcoding in a throwaway sandbox that outputs some hard-to-misparse intermediate format like a raw pixel array. But S3 doesn't do transcoding.