FileUpload
The filename rules and the extension policy, run for real on
whatever you type. This page stores nothing — it calls
sanitize_name and inspect_name, which never touch the
filesystem.
| You sent | ../../etc/passwd |
|---|---|
| Stored as | passwd |
| Policy | rejected — the file has no extension<br> |
Worth trying
| Client filename | Stored as | Policy |
|---|---|---|
../../etc/passwd | passwd | rejected the file has no extension<br> |
C:\Windows\system32\evil.exe | evil.exe | rejected disallowed extension '.exe' in filename<br> |
shell.php.jpg | shell.php.jpg | rejected disallowed extension '.php' in filename<br> |
CON.txt | _CON.txt | rejected extension '.txt' is not permitted<br> |
holiday photo.PNG | holiday photo.PNG | accepted |
.hidden.png | hidden.png | accepted |
a<b>c:d*e?.jpg | abcde.jpg | accepted |
archive.tar.gz | archive.tar.gz | rejected extension '.gz' is not permitted<br> |
report.pdf | report.pdf | accepted |
noextension | noextension | rejected the file has no extension<br> |
This policy allows png jpg jpeg gif pdf with
strict_ext on, which is why shell.php.jpg fails on its
middle extension rather than its last one.
What this page cannot show you
Two of the strongest guards only apply to real bytes, so they are exercised by
the admin media manager rather than here:
magic-byte sniffing, where the sniffed content type — not the
client's claim — decides accept or reject; and streaming, where
file parts go to temp files as they arrive so a large upload never becomes a
large process. Destinations are opened O_NOFOLLOW and created with
O_EXCL, so a symlink cannot redirect a write and a collision cannot
clobber an existing file.
Sign in as demo / demodemo and try to smuggle something
past it. Uploads are cleared every hour.