Hacker News Reader

you had me paraonoid enough there to check :)

It's ok though, the fix I applied was a little more elaborate than indicated above.

thanks anyway!

It's really hard to harden yourself against code getting interpreted by the browser (and thus allowing someone to steal cookies and impersonate other users). Here's a long article on exactly how complex it is (as known today): http://tstarling.com/blog/2008/12/secure-web-uploads/

Personally, I just don't trust web uploads on the same domain. Put them on a subdomain or better yet a completely separate domain, preferably served out of something set up to never execute any code whatsoever.

Excellent read Timothy, thank you. I have changed some of the code because of this article. I also checked the history of all uploads to see if any of the holes mentioned had been used, and apparently there was at least one instance of somebody trying the .js route but they got hung up on the fact that the file names are changed after every download.

Reply on news.ycombinator.com