Viewing profile — blueimp

You're welcome! :)

For local automated testing of mobile browsers on both iOS and Android you probably want to have a look at https://appium.io/ , which uses the Webdriver protocol. If you want to ru…

Well you can use the provided images without forking and they both support running Chrome/Firefox headless without X. But since I'm building this in my personal time there's no pro…

Hey aboutruby, the way to use this project is the following: 1. Checkout the repo 2. Follow the README to setup the different browsers 3. Run the tests against the included sample …

Any Framework (including WebdriverIO) that uses the W3C Webdriver API or the older Selenium JSON Wire Protocol requires the appropriate driver for each browser. In my opinion that'…

While Docker definitely supports tagging versions, I've decided to not tag the example images for now. The main reason for this is that it would be very difficult to properly expre…

I'd say it's definitely hard to write cross-browser automated tests that are not flaky. Some of that is due to unreliably implementations of the Webdriver API (or the previous Sele…

I think puppeteer is an interesting project, but right now it's Chrome-only and therefore pretty much useless for cross-browser testing. Even with support for Firefox, it would sti…

Hey Vinni, you can definitely use this project and the containerized versions of Chrome/Firefox on CI - in fact that's its primary use case. The way this project is setup is to use…

Hi HN, recently there have been a lot of discussions about Chrome's dominance on the Web leading to many websites being broken for alternative browsers. I think one of the reasons …

Since this is about vulnerabilities in a third-party dependency (ImageMagick/Ghostscript), the recommendation in the blog post to use the GD library instead (what the image_library…

If the upload directory is securely configured, no. Please refer to the vulnerability documentation here to see if you are affected: https://github.com/blueimp/jQuery-File-Upload/b…

Please refer to the vulnerability documentation here to see if you are affected: https://github.com/blueimp/jQuery-File-Upload/blob/master/VU...

That was my thought as well. I think one of the reasons nobody reported this earlier was that people simply assumed that .htaccess support was the default - Larry Cashdollar, the s…

I do think that my project is responsible and not Apache, since I provided sample code that was not secure by default when used in a default Apache configuration as is. However I w…

I agree with you that this would be the safer route. For a production file upload service, file uploads should ideally stored in a specialized blob store, e.g. Amazon S3 or Google …

Thanks! Comments like yours are what keeps me motivated to continue contributing to open source software. But although the title is somewhat click-bait, I still think this counts a…

Thanks! I already got a helpful pull request for the main README.me that I've updated by now with - Security-related releases on top of the main page: https://github.com/blueimp/jQ…

Although I agree with you in a general sense, in this case there was no blacklist mistakenly used. If the server is configured to serve uploaded files securely, it is feasible to a…

Thanks a lot! By now I've also updated the project page with - Security-related releases on top of the main page: https://github.com/blueimp/jQuery-File-Upload#%EF%B8%8F-secu... - …

Hehe, thanks! :)

For a breakdown on how this could happen, please see my comment here: https://news.ycombinator.com/item?id=18267309

Larry was also super helpful in identifying the underlying issue and very polite in his emails. Would definitely write another security vulnerability into my code again if I knew t…

Thanks for your comment. I think in situations like this it's important to take responsibility and provide as much transparency as possible.

Agreed - in addition to performance issues, there are also security issues if .htaccess support is enabled - because they can override security settings. Originally the PHP example…