new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

file_upload/isolation

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Use tenant-prefixed paths for all file storage

Generate tenant storage prefix using hashed path: tenant_hash = hashlib.sha256(tenant_id.encode()).hexdigest()[:12]; prefix = f"tenants/{tenant_hash}". All file paths must be prefixed with this tenant-specific prefix.

Sanitize file paths to prevent directory traversal in multi-tenant storage

When building S3 keys or file paths, sanitize by lstrip('/') to remove leading slashes and replace '..' with empty string to prevent directory traversal attacks.

Store tenant-id in S3 object metadata for verification

Include tenant_id in S3 object Metadata dict when uploading files. On retrieval, verify that response Metadata['tenant-id'] matches the current tenant_id. Raise SecurityException on mismatch.

Use tenant-specific KMS encryption keys for high-security tenants

For BUSINESS and ENTERPRISE tier tenants, provision separate AWS KMS keys. Set ServerSideEncryption='aws:kms' and SSEKMSKeyId=tenant_kms_key_id when uploading objects.

Implement presigned URL generation with tenant validation

Generate presigned S3 URLs using boto3 s3.generate_presigned_url() with tenant-prefixed keys. The URL includes cryptographic signature that validates the tenant context is embedded in the URL path.

Implement tenant data deletion during offboarding

Implement delete_tenant_data(tenant_id) that deletes all S3 objects under the tenant prefix using paginated list_objects_v2 with Prefix parameter and batch delete_objects calls.

Give your agent this brain