131: Start Securing Elixir and Phoenix
Thinking Elixir Podcast
00:00
What Is the Best Way to Block IP Addresses?
In many insecure implementations, if you allow users to set the content type of what they're uploading, then somebody uploads an HTML document. And when the image gets rendered back, it's not rendered as an image, it's actually a piece of HTML. So the vulnerability described here is on profile upload with photos and they upload their malicious example which can be stolen by attacker or something like that. It was also used in Sami worm where MySpace was completely taken over by this cross site scripting site Worm. Proact has been able to publish Elixir code demonstrating these patterns so there will be more information coming out about them soon.
Transcript
Play full episode
