Tutorial: Form upload in vibe.d
    NVolcz via Digitalmars-d-announce 
    digitalmars-d-announce at puremagic.com
       
    Thu Dec  8 12:48:52 PST 2016
    
    
  
On Tuesday, 6 December 2016 at 22:28:04 UTC, aberba wrote:
> https://aberba.github.io/2016/form-upload-in-vibe-d/u
Love the article! Please keep writing tutorials like this :-D.
Feedback:
1.
The upload function is (kind of) vulnerable against path 
traversal:
   moveFile(file.tempPath, Path("./public/uploads") ~ 
file.filename);
If a file named "../SomeOtherFile.htm" is uploaded the server 
will hit this assert:
https://github.com/rejectedsoftware/vibe.d/blob/master/core/vibe/core/path.d#L426
Denail of Service attack!
When the application is compiled with the release flag the assert 
will be omitted and the path traversal will work.
2.
It would be more beginner friendly if you also described how to 
add the upload function to the router.
3.
Your github link on the left side is broken. Discovered this when 
I was looking for a zip with the finished code.
    
    
More information about the Digitalmars-d-announce
mailing list