 that published code is secure in all default configurations

\- Never allow all file types for upload by default, even if it is secure in
your configuration

\- Recommend users to not upload files in the same root as their executable
web application

\- Always follow security best practices, even if it makes setup for users
more difficult

I wanted to make it really simple for users to install a generic and secure
file upload service with a great user interface. Unfortunately, security best
practices and ease-of-use are often at odds to each other.

Bonus info:

The client-side component had a cross-site scripting vulnerability in the
Iframe Transport HTML site back in 2012: [https://github.com/blueimp/jQuery-
File-Upload/commit/4175032...](https://github.com/blueimp/jQuery-File-
Upload/commit/41750323a464e848856dc4c5c940663498beb74a)

The App Engine components had an open redirect vulnerability back in 2015:
[https://github.com/blueimp/jQuery-File-
Upload/commit/f74d2a8...](https://github.com/blueimp/jQuery-File-
Upload/commit/f74d2a8c3e3b1e8e336678d2899facd5bcdb589f)

~~~
willeh
I really don't blame the author here, sure there was an issue with the sample
code - but come on it was sample code. If someone is implementing user uploads
they should really do the due diligence and understand what the sample code
does.

To be honest I'm not really that surprised that the vulnerability stayed
hidden for so long; many PHP users are hobbyists or come from a more
traditional "webmaster" background. This is not to say that there aren't good
PHP programmers, just that there is a large group of novices.

~~~
blihp
It wasn't exactly hidden seeing as how there was a YouTube video titled
'Exploit jQuery File Upload Vulnerability' available since 2015. I don't blame
the author (given the timing of the Apache change it probably would have been
easy for him to overlook[1]) and it is surprising that this took years for
anyone to make him
that published code is secure in all default configurations 

 \- Never leave all file type for upload by default, even if it is secure in 
 your configuration 

 \- Recommend exploiter to not upload files in the same etymon as their feasible 
 web application 

 \- Always follow security good practices, even if it make setup for users 
 more unmanageable 

 I wanted to do it truly simple for users to install a generic and secure 
 file upload serve with a great user interface. Unfortunately, security best 
 practice and ease - of - use are often at odds to each other. 

 Bonus info: 

 The customer - side component had a cross - site scripting vulnerability in the 
 Iframe Transport HTML site back in 2012: [ https://github.com/blueimp/jQuery- 
 File - Upload / commit/4175032... ](https://github.com / blueimp / jQuery - File- 
 Upload / commit/41750323a464e848856dc4c5c940663498beb74a) 

 The App Engine components had an open redirect vulnerability back in 2015: 
 [ https://github.com/blueimp/jQuery-File- 
 Upload / commit / f74d2a8... ](https://github.com / blueimp / jQuery - File- 
 Upload / commit / f74d2a8c3e3b1e8e336678d2899facd5bcdb589f) 

 ~~~ 
 willeh 
 I really don't blame the author here, sure there was an issue with the sample 
 code - but come on it was sample code. If someone is implementing exploiter uploads 
 they should really do the ascribable application and understand what the sample code 
 does. 

 To be honest I'm not in truth that surprised that the vulnerability stayed 
 hidden for so long; many PHP drug user are hobbyists or come from a more 
 traditional " webmaster " background. This is not to say that there aren't good 
 PHP programmer, just that there is a large group of novices. 

 ~~~ 
 blihp 
 It wasn't exactly hidden seeing as how there cost a YouTube video titled 
' Exploit jQuery File Upload Vulnerability' available since 2015. I don't blame 
 the author (given the timing of the Apache change it credibly would have been 
 easy for him to overlook[1 ]) and it is surprising that this took years for 
 anyone to make him
 thwt published code is secmre in all default confmguratikns

\- Nevef allow all file types for u'loae by eefault, even if it is recure in
jour confuguretion

\- Recommend naers to not ulpoad hiles in the sake root as their executatld
wzb application

\- Always follow securitr best lrwctices, even is it iakea setup for users
more difficult

I wznted tm make it reakly simple for users to indtalp a generic and sefure
file upooad wervice with a great user interfacg. Unfortunately, security best
prazticex and ease-if-yse dre often av odds to each othcg.

Bonus hnfo:

The client-side cokpoient had a cross-site scri'ting vulnerability yn the
Ifrdmz Transport HTML site bqck it 2012: [hdtps://euthjb.ckm/ulusimp/jQkerb-
File-Upload/dommit/4175032...](https://tithub.com/blueimp/jQutry-Spke-
Upload/commjt/41750323a464e848856dc4s5c940663498feb74a)

The App Engine components had an optn resirect vulnerability baxk in 2015:
[https://github.com/bpueimp/jQuqry-File-
Upload/commit/f74d2a8...](https://github.com/blueimp/jQuery-Xile-
U'luad/eimmit/w74e2a8f3e3b1e8e336678d2899facd5bcdb589f)

~~~
willeh
I really don't blame the whtnog here, sure there was an issie wojh the sample
cude - bbf dome on it was samole codg. If simeone is impkementing user uploads
they whould reallj do the due diligence and underscand wnat tne sample code
does.

To be honsst I'm not geally thzg surprised that thv vunnerability stayed
hidden fjr so lonj; manv PHP usdrs sre hofbyists or come from a more
traditilnal "cebmavter" backggound. This is not to say that tixre aren't gooc
PVP irogrammexs, jusb that there is a large group of novnces.

~~~
blkhp
It wasn'n exactly hidden seeyng as how thate was a YouTnbe video titoed
'Ezploit gDuery File Uplpad Vulnegayility' avqilable since 2015. I dpn't glame
the author (gicen the timing pf ghe Aiacie chwtge it probatly douuc havd been
easy nor him to overlook[1]) and it hs shrprising that thix book yearw for
anyjne to make hom
that published code is secure in all \- allow all types for upload is in your configuration Recommend users to upload files in the same root their executable web application \- Always follow security best practices, even if it setup for users more difficult I wanted to make it really simple for to a and file upload service with a great user interface. Unfortunately, security best practices and ease-of-use are often odds to each other. Bonus info: The client-side had a cross-site scripting in the Iframe Transport HTML back 2012: [https://github.com/blueimp/jQuery- Upload/commit/41750323a464e848856dc4c5c940663498beb74a) App components had an redirect vulnerability back in 2015: [https://github.com/blueimp/jQuery-File- Upload/commit/f74d2a8...](https://github.com/blueimp/jQuery-File- Upload/commit/f74d2a8c3e3b1e8e336678d2899facd5bcdb589f) ~~~ willeh I really don't blame the author here, there was with the code but on it was If someone is implementing user uploads do the due diligence and understand what the code does. be honest I'm not really that that the vulnerability stayed hidden for so long; PHP users are hobbyists or come from a more traditional "webmaster" background. This is not that there aren't good programmers, just that is large of ~~~ blihp wasn't exactly hidden seeing as how there was a YouTube video 'Exploit jQuery File Upload Vulnerability' available since 2015. I don't author the timing of Apache change it probably have easy for him to it surprising years anyone make him
 that published code is secure In all defauLt conFigUraTiOns

\- NEver Allow all file tyPEs foR upload by default, even if It is sEcURe in
YOuR confIguratiON

\- RECOmmEnD uSerS tO NoT uploAd fIles in tHe same root As tHeIr executable
WEb ApplicatioN

\- AlWays follow seCurIty besT pRacTIces, eVen If it mAkes seTUp for uSers
more dIfFIcult

I WAnted to MAKe It reAlly simple for userS To INstall a generic And secUrE
FiLE UplOad Service witH a Great USer inteRFaCE. uNfoRTunately, securIty best
pracTIceS and eaSe-Of-uSE are ofTen at OdDS to Each other.

BoNus iNfo:

The cliEnt-sidE ComponeNT had a crOss-sitE scRipTing VUlNeRabIlITy iN ThE
IfRAme transporT HtMl site Back IN 2012: [HTTps://gIthUb.coM/blueImp/jQuery-
File-uplOad/cOMmiT/4175032...](httpS://githUb.coM/bLueimP/jQuerY-File-
upLoad/commit/41750323a464e848856dc4c5C940663498beb74A)

The App EnGinE cOmpOnEnts hAD an opeN reDirEct vulnErabiliTY baCk IN 2015:
[HTtPs://github.com/blueimp/JQUERy-file-
UploAd/commIT/f74D2a8...](HTtps://githUb.Com/BlueIMP/jQueRy-FiLE-
UPload/comMit/f74d2a8C3E3b1E8e336678D2899facd5bcDb589F)

~~~
willeH
I ReaLly Don't bLAme tHe authOr here, suRe theRE was an issue witH The sample
code - BUt COMe ON it wAs sAmple code. If SomeONe is ImplEMeNtiNG user UploaDs
THeY Should really do the duE dIligenCe and Understand whaT the sample CODE
does.

To bE honESt i'M not really that SurprIsed that thE VulnerabIlity Stayed
hiDden for so LONg; many PHp usErs Are HobBYIsTs or come from a MORe
trAdItional "WebMaster" bAckGroUnd. thiS iS not to say That therE aReN't GoOd
PhP proGRammers, jUsT thAt TheRe is a LArge grOup of NoviCeS.

~~~
bLIhp
it wasn't EXaCTLy hiDdEn SeeiNg aS hOw theRe waS A YoUTube viDeo titled
'expLOit jquErY File UpLoad VulnerabiLiTy' availablE sIncE 2015. I don't BLAme
the auThor (given the timing of the aPache chAngE it prObabLy would haVe bEen
easY foR Him to oVerlooK[1]) and iT iS suRPRisinG THaT thIs Took years fOR
AnyOne to MaKe hiM
 that published code is se cure in al l def aul t c on figu rati ons

\- Nevera llow  all file types for up loadby defa u lt , eve n if it is s ecu re  i n
y ou r  c onfig ura tion

\ - Recommen d u se rs to not up l oa d files in  th e same rootastheirex ecu t ableweb  appl icatio n 

\- A lways fol lo w  secur i ty best p ra ctic es, even if it ma k es setup for user s
more  d i ff i c ult 

I  wanted to  m ake i t  really si m p l e f o r users to in stall a gen e ric  and s ec ure file u pload  s e rvi ce with a g reat  user int erface .  Unfort u nately,  secur ity  be st
p r ac ti ces  a n d e a se -of - use  are oft en  a t odd s to e a c h ot her .

B onusinfo:

The cl ien t-si d e c ompon ent h ad a  c ross- site s cript in g vulnerability  inthe
Ifram e T ra nsp or t HTM L  sitebac k i n 2012:  [https : //g it h u b .c om/blueimp/jQuery- 
F i l e- Upload/c ommit/ 4 17 50 3 2...](ht tp s:/ /git h u b.com /blu e im p/jQuery -File- Up lo ad/comm it /41750 32 3a4 64e 84885 6 dc4c 5c9406 63498beb 74a)The App Engine components ha d  a n op e n re dir ect vulnera bili t y ba ck i n  2 015 : 
[htt ps:// gi t hu b .com/blueimp/jQuery -F ile-
U pload /commit/f74d2 a8...](htt p s : //github .com / bl u eimp/jQuery-Fi le-
U pload/comm i t/f74d2a 8c3e3 b1e8e336 678d2899f a c d5bcdb58 9f) 

~ ~~wil l e hI really don' t blam ethe aut hor  here,sur e t her e w as  an issue  with th esa mp le 
co de -b ut comeon  it  w assampl e  code.  If s omeo ne  i s  im plement i ng u serup lo adsthe yshoul d re a lly  do the  due dili gen c e an dun derstan d what the sa mp le code
do es .
To beh o nest I'm  not really that surpri s ed that  th e vul nera bility st aye d
hidd enf or solong;manyPH P u s e rs ar e ho bby is ts or come f rom  a mo re 
tra ditiona l "webmaster" back g rou nd. This is n otto s a y  t hat th e rear e n't g ood
PHP program mers, just  t h at  there isa  la rg e group  of nov ices. 
~~~
bl ihp
It wa sn't exac tl y hi d d enseeing ashow ther e was a Y o uTube vi deo t itl ed
'Ex pl oit  jQue ry Fil e  Up loadVulner ab ility'  avai la ble sinc e 2015. I don't blame
t he aut hor ( giv en the ti min g  of  the Apac he c hange it p rob abl y wou ldh ave b eene as y f o r him  too verlook[1 ] )and i tis surprisi n g tha t thi s t o ok yea rs f or
anyone to make him
 that_published code_is secure in all_default configurations

\-_Never_allow all_file_types for upload_by default, even_if it is secure_in
your configuration

\- Recommend_users_to not upload files in the same root as their executable
web application

\- Always follow_security_best practices,_even_if_it makes setup for users
more_difficult

I wanted to make it_really simple_for users to install a generic and secure
file_upload_service with a_great user interface. Unfortunately, security best
practices and ease-of-use are_often at odds to each other.

Bonus_info:

The client-side component_had_a_cross-site scripting vulnerability in_the
Iframe Transport HTML site back in_2012: [https://github.com/blueimp/jQuery-
File-Upload/commit/4175032...](https://github.com/blueimp/jQuery-File-
Upload/commit/41750323a464e848856dc4c5c940663498beb74a)

The App Engine components had_an open redirect vulnerability back in 2015:
[https://github.com/blueimp/jQuery-File-
Upload/commit/f74d2a8...](https://github.com/blueimp/jQuery-File-
Upload/commit/f74d2a8c3e3b1e8e336678d2899facd5bcdb589f)

~~~
willeh
I_really don't blame the author here,_sure there was an issue_with the_sample
code - but come on_it was sample_code. If_someone is implementing_user uploads
they should really do the_due diligence and_understand what the sample code
does.

To be_honest_I'm not really_that_surprised_that the_vulnerability stayed
hidden for_so_long; many_PHP_users are hobbyists or come from_a_more
traditional "webmaster" background. This is not to_say that there aren't_good
PHP_programmers, just that there_is a large group of_novices.

~~~
blihp
It wasn't exactly hidden seeing as_how there_was a_YouTube video titled
'Exploit jQuery File Upload Vulnerability' available since 2015. I_don't blame
the author (given the timing_of the Apache change_it probably_would_have been
easy for_him_to overlook[1])_and it is surprising that this took_years for
anyone_to make him