Does websites know the folder name when I upload a file from that folder?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
If I'm uploading a file to a website from a folder called "XXX", does the website know that I'm uploading that file from "XXX"?
In essence, will the website know the folder name?
Note: I use Safari on Mac.
safari upload
asked Jan 26 at 15:37
delickdelick
83
add a comment |
If I'm uploading a file to a website from a folder called "XXX", does the website know that I'm uploading that file from "XXX"?
In essence, will the website know the folder name?
Note: I use Safari on Mac.
safari upload
asked Jan 26 at 15:37
delickdelick
83
I believe it is masked by the browser that is uploading the file.
– Moab
Jan 26 at 15:40
@Moab I'm using Safari by the way. Is that true for Safari?
– delick
Jan 26 at 15:41
I think it is true for all browsers.
– Moab
Jan 26 at 15:43
@Moab Ah great, thanks! May I ask how did you know this?
– delick
Jan 26 at 15:57
Because it would be a huge security hole if they did not.
– Moab
Jan 26 at 16:34
add a comment |
If I'm uploading a file to a website from a folder called "XXX", does the website know that I'm uploading that file from "XXX"?
In essence, will the website know the folder name?
Note: I use Safari on Mac.
safari upload
asked Jan 26 at 15:37
delickdelick
83
If I'm uploading a file to a website from a folder called "XXX", does the website know that I'm uploading that file from "XXX"?
In essence, will the website know the folder name?
Note: I use Safari on Mac.
safari upload
safari upload
asked Jan 26 at 15:37
delickdelick
83
asked Jan 26 at 15:37
delickdelick
83
edited Jan 26 at 15:42
delick
asked Jan 26 at 15:37
delickdelick
83
asked Jan 26 at 15:37
delickdelick
83
asked Jan 26 at 15:37
delickdelick
83
83
I believe it is masked by the browser that is uploading the file.
– Moab
Jan 26 at 15:40
@Moab I'm using Safari by the way. Is that true for Safari?
– delick
Jan 26 at 15:41
I think it is true for all browsers.
– Moab
Jan 26 at 15:43
@Moab Ah great, thanks! May I ask how did you know this?
– delick
Jan 26 at 15:57
Because it would be a huge security hole if they did not.
– Moab
Jan 26 at 16:34
add a comment |
I believe it is masked by the browser that is uploading the file.
– Moab
Jan 26 at 15:40
@Moab I'm using Safari by the way. Is that true for Safari?
– delick
Jan 26 at 15:41
I think it is true for all browsers.
– Moab
Jan 26 at 15:43
@Moab Ah great, thanks! May I ask how did you know this?
– delick
Jan 26 at 15:57
Because it would be a huge security hole if they did not.
– Moab
Jan 26 at 16:34
I believe it is masked by the browser that is uploading the file.
– Moab
Jan 26 at 15:40
I believe it is masked by the browser that is uploading the file.
– Moab
Jan 26 at 15:40
@Moab I'm using Safari by the way. Is that true for Safari?
– delick
Jan 26 at 15:41
@Moab I'm using Safari by the way. Is that true for Safari?
– delick
Jan 26 at 15:41
I think it is true for all browsers.
– Moab
Jan 26 at 15:43
I think it is true for all browsers.
– Moab
Jan 26 at 15:43
@Moab Ah great, thanks! May I ask how did you know this?
– delick
Jan 26 at 15:57
@Moab Ah great, thanks! May I ask how did you know this?
– delick
Jan 26 at 15:57
Because it would be a huge security hole if they did not.
– Moab
Jan 26 at 16:34
Because it would be a huge security hole if they did not.
– Moab
Jan 26 at 16:34
add a comment |
1 Answer
1
active
oldest
votes
The browser is not supposed to send the folder part to the website,
as this might be taken as a form of attack.
From
RFC 6266 - Use of the Content-Disposition Header Field in the
Hypertext Transfer Protocol (HTTP)
:
Recipients MUST NOT be able to write into any location other than
one to which they are specifically entitled. To illustrate the
problem, consider the consequences of being able to overwrite
well-known system locations (such as "/etc/passwd"). One strategy
to achieve this is to never trust folder name information in the
filename parameter, for instance by stripping all but the last
path segment and only considering the actual filename (where 'path
segments' are the components of the field value delimited by the
path separator characters "" and "/").
Any browser that includes the folder-part in the sent file-name risks being
cut-off by security services on the server website.
As far as I know, no browser does it.
answered Jan 26 at 19:32
harrymcharrymc
264k14273582
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1398734%2fdoes-websites-know-the-folder-name-when-i-upload-a-file-from-that-folder%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The browser is not supposed to send the folder part to the website,
as this might be taken as a form of attack.
From
RFC 6266 - Use of the Content-Disposition Header Field in the
Hypertext Transfer Protocol (HTTP)
:
Recipients MUST NOT be able to write into any location other than
one to which they are specifically entitled. To illustrate the
problem, consider the consequences of being able to overwrite
well-known system locations (such as "/etc/passwd"). One strategy
to achieve this is to never trust folder name information in the
filename parameter, for instance by stripping all but the last
path segment and only considering the actual filename (where 'path
segments' are the components of the field value delimited by the
path separator characters "" and "/").
Any browser that includes the folder-part in the sent file-name risks being
cut-off by security services on the server website.
As far as I know, no browser does it.
answered Jan 26 at 19:32
harrymcharrymc
264k14273582
add a comment |
The browser is not supposed to send the folder part to the website,
as this might be taken as a form of attack.
From
RFC 6266 - Use of the Content-Disposition Header Field in the
Hypertext Transfer Protocol (HTTP)
:
Recipients MUST NOT be able to write into any location other than
one to which they are specifically entitled. To illustrate the
problem, consider the consequences of being able to overwrite
well-known system locations (such as "/etc/passwd"). One strategy
to achieve this is to never trust folder name information in the
filename parameter, for instance by stripping all but the last
path segment and only considering the actual filename (where 'path
segments' are the components of the field value delimited by the
path separator characters "" and "/").
Any browser that includes the folder-part in the sent file-name risks being
cut-off by security services on the server website.
As far as I know, no browser does it.
answered Jan 26 at 19:32
harrymcharrymc
264k14273582
add a comment |
The browser is not supposed to send the folder part to the website,
as this might be taken as a form of attack.
From
RFC 6266 - Use of the Content-Disposition Header Field in the
Hypertext Transfer Protocol (HTTP)
:
Recipients MUST NOT be able to write into any location other than
one to which they are specifically entitled. To illustrate the
problem, consider the consequences of being able to overwrite
well-known system locations (such as "/etc/passwd"). One strategy
to achieve this is to never trust folder name information in the
filename parameter, for instance by stripping all but the last
path segment and only considering the actual filename (where 'path
segments' are the components of the field value delimited by the
path separator characters "" and "/").
Any browser that includes the folder-part in the sent file-name risks being
cut-off by security services on the server website.
As far as I know, no browser does it.
answered Jan 26 at 19:32
harrymcharrymc
264k14273582
The browser is not supposed to send the folder part to the website,
as this might be taken as a form of attack.
From
RFC 6266 - Use of the Content-Disposition Header Field in the
Hypertext Transfer Protocol (HTTP)
:
Recipients MUST NOT be able to write into any location other than
one to which they are specifically entitled. To illustrate the
problem, consider the consequences of being able to overwrite
well-known system locations (such as "/etc/passwd"). One strategy
to achieve this is to never trust folder name information in the
filename parameter, for instance by stripping all but the last
path segment and only considering the actual filename (where 'path
segments' are the components of the field value delimited by the
path separator characters "" and "/").
Any browser that includes the folder-part in the sent file-name risks being
cut-off by security services on the server website.
As far as I know, no browser does it.
answered Jan 26 at 19:32
harrymcharrymc
264k14273582
answered Jan 26 at 19:32
harrymcharrymc
264k14273582
answered Jan 26 at 19:32
harrymcharrymc
264k14273582
answered Jan 26 at 19:32
harrymcharrymc
264k14273582
264k14273582
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1398734%2fdoes-websites-know-the-folder-name-when-i-upload-a-file-from-that-folder%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I believe it is masked by the browser that is uploading the file.
– Moab
Jan 26 at 15:40
@Moab I'm using Safari by the way. Is that true for Safari?
– delick
Jan 26 at 15:41
I think it is true for all browsers.
– Moab
Jan 26 at 15:43
@Moab Ah great, thanks! May I ask how did you know this?
– delick
Jan 26 at 15:57
Because it would be a huge security hole if they did not.
– Moab
Jan 26 at 16:34