• 1 Post
  • 520 Comments
Joined 3 years ago
Cake day: June 12th, 2023
  • atzanteol@sh.itjust.workstoSelfhosted@lemmy.world•Self-Host Weekly #152: WrappedEnglish
    31·
    5 days ago

    Non-containerized applications. Not in a container. It’s not complicated. Running “on bare metal” sounds cool but it’s a wildly inaccurate description. Containerized applications run on the system natively just like non-containerized applications. So if one of them runs “on bare metal” then then others do as well.

    But historically “on bare metal” is used for embedded or micro-controllers where you don’t have an OS.

  • atzanteol@sh.itjust.workstoSelfhosted@lemmy.world•Created a self-hosted API for CRUD-ing JSON data on different storage providers (local, S3, minIO, ...).English
    4·
    6 days ago

    You know what? Rather than over-complicate things you can probably just check that filenames only contain a small set of white-listed chars. [a-zA-z-._] (and != ‘…’ or ‘.’) or something.

    And one other nit-pick if you’re up for more code-review - your authentication logic should probably be inverted:

    if !ok || user != session.config.username ||
				pass != session.config.password

    I’d change that to be something like

    if ok && user == session.config.username && pass == session.config.password {
   // do login
} else {
   // not auth
}

    There’s a whole category of security errors where an exception in logic like that causes the code to skip the “you’re not allowed” logic and go right to the “you’re allowed!” block. It’s more of an issue with languages that support exceptions but it’s still considered a best practice generally (it’s also typically easier to read).