Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Misleading information in README #32

Open
vasartam opened this issue Aug 31, 2022 · 2 comments
Open

Misleading information in README #32

vasartam opened this issue Aug 31, 2022 · 2 comments

Comments

@vasartam
Copy link

Hello!

I'm considering using this tool to perform virus scans in my project. Hope it fits perfectly!

While reading documentation in README file, noticed these lines of code:

4. The only request that will be tested will have methods POST/PUT/PATCH

This seems like a hole in the security. A malicious actor could just change the method to GET, for example, and, if the application doesn't care about the HTTP method used, it could receive a malicious file through GET request.

Found out that you already changed the conditions under which the request would be forwarded to a scanner in this issue: #21.

So maybe you just forgot to update the docs? If so, I could rephrase that and submit a PR, if you will.

@tagliala
Copy link
Member

Hi, thanks for reporting this.

So maybe you just forgot to update the docs?

I would say it is most probably the case, let's double check

@tagliala
Copy link
Member

tagliala commented Sep 1, 2022

Hi @vasartam, feel free to submit a PR to fix the readme

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants