{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T18:37:47Z","timestamp":1784399867060,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":36,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,5,13]],"date-time":"2024-05-13T00:00:00Z","timestamp":1715558400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100006374","name":"Google","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Cyber Florida"},{"DOI":"10.13039\/501100006374","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2039606,2219920,211388"],"award-info":[{"award-number":["2039606,2219920,211388"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006374","name":"Microsoft","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006374","name":"National Security Agency","doi-asserted-by":"publisher","award":["H982302110324"],"award-info":[{"award-number":["H982302110324"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,5,13]]},"DOI":"10.1145\/3589334.3645342","type":"proceedings-article","created":{"date-parts":[[2024,5,8]],"date-time":"2024-05-08T07:08:13Z","timestamp":1715152093000},"page":"1573-1584","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["(In)Security of File Uploads in Node.js"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2650-2055","authenticated-orcid":false,"given":"Harun","family":"Oz","sequence":"first","affiliation":[{"name":"Florida International University, Miami, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4891-160X","authenticated-orcid":false,"given":"Abbas","family":"Acar","sequence":"additional","affiliation":[{"name":"Florida International University, Miami, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4114-5321","authenticated-orcid":false,"given":"Ahmet","family":"Aris","sequence":"additional","affiliation":[{"name":"Florida International University, Miami, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-5472-141X","authenticated-orcid":false,"given":"G\u00fcliz Seray","family":"Tuncay","sequence":"additional","affiliation":[{"name":"Google, Mountain View, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7841-3409","authenticated-orcid":false,"given":"Amin","family":"Kharraz","sequence":"additional","affiliation":[{"name":"Florida International University, Miami, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9823-3464","authenticated-orcid":false,"given":"Selcuk","family":"Uluagac","sequence":"additional","affiliation":[{"name":"Florida International University, Miami, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,5,13]]},"reference":[{"key":"e_1_3_2_2_1_1","volume-title":"50 Shades of Support: A Device-Centric Analysis of Android Security Updates. In Network and Distributed System Security Symposium.","author":"Acar Abbas","year":"2024","unstructured":"Abbas Acar, G\u00fcliz Seray Tuncay, Esteban Luques, Harun Oz, Ahmet Aris, and Selcuk Uluagac. 2024. 50 Shades of Support: A Device-Centric Analysis of Android Security Updates. In Network and Distributed System Security Symposium."},{"key":"e_1_3_2_2_2_1","volume-title":"IEEE Symposium on Computers and Communications.","author":"Amirani Mehdi Chehel","unstructured":"Mehdi Chehel Amirani, Mohsen Toorani, and A. Beheshti. 2008. A new approach to content-based file type detection. In IEEE Symposium on Computers and Communications."},{"key":"e_1_3_2_2_3_1","volume-title":"Server-Side Detection of Content Sniffing Attacks. In International Symposium on Software Reliability Engineering.","author":"Barua Anton","year":"2011","unstructured":"Anton Barua, Hossain Shahriar, and Mohammad Zulkernine. 2011. Server-Side Detection of Content Sniffing Attacks. In International Symposium on Software Reliability Engineering."},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3507657.3528560"},{"key":"e_1_3_2_2_5_1","volume-title":"Virtual Realm: An Analysis of Extended Reality Devices","author":"Cayir D.","year":"2024","unstructured":"D. Cayir, A. Acar, R. Lazzeretti, M. Angelini, M. Conti, and S. Uluagac. 2024. Augmenting Security and Privacy in the Virtual Realm: An Analysis of Extended Reality Devices. IEEE Security & Privacy (2024)."},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3064176.3064188"},{"key":"e_1_3_2_2_7_1","volume-title":"UChecker: Automatically Detecting PHP-Based Unrestricted File Upload Vulnerabilities. In 2019 49th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN).","author":"Huang Jin","year":"2019","unstructured":"Jin Huang, Yu Li, Junjie Zhang, and Rui Dai. 2019. UChecker: Automatically Detecting PHP-Based Unrestricted File Upload Vulnerabilities. In 2019 49th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN)."},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3471621.3471859"},{"key":"e_1_3_2_2_9_1","volume-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses.","author":"Koishybayev Igibek","year":"2020","unstructured":"Igibek Koishybayev and Alexandros Kapravelos. 2020. Mininode: Reducing the Attack Surface of Node.js Applications. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23126"},{"key":"e_1_3_2_2_11_1","unstructured":"R. Lerdorf K. Tatroe B. Kaehms R. McGredy N. Torkington and P.M. Ferguson. 2002. Programming PHP. O'Reilly Media."},{"key":"e_1_3_2_2_12_1","unstructured":"Xiaowei Li and Yuan Xue. 2014. A Survey on Server-Side Approaches to Securing Web Applications. ACM Comput. Surv. (2014)."},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2814270.2814272"},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516685"},{"key":"e_1_3_2_2_15_1","volume-title":"European Symposium on Research in Computer Security. Springer.","author":"Mekdad Yassine","year":"2021","unstructured":"Yassine Mekdad, Giuseppe Bernieri, Mauro Conti, and Abdeslam El Fergougui. 2021. The rise of ICS malware: A comparative analysis. In European Symposium on Research in Computer Security. Springer."},{"key":"e_1_3_2_2_16_1","unstructured":"MITRE. 2022. CWE-1287: Improper Validation of Specified Type of Input. https:\/\/cwe.mitre.org\/data\/definitions\/1287.html."},{"key":"e_1_3_2_2_17_1","volume-title":"Processing Dangerous Paths--On Security and Privacy of the Portable Document Format. In Network and Distributed System Security Symposium.","author":"M\u00fcller Jens","year":"2021","unstructured":"Jens M\u00fcller, Dominik Noss, Christian Mainka, Vladislav Mladenov, and J\u00f6rg Schwenk. 2021. Processing Dangerous Paths--On Security and Privacy of the Portable Document Format. In Network and Distributed System Security Symposium."},{"key":"e_1_3_2_2_18_1","volume-title":"Modular Call Graph Construction for Security Scanning of Node.Js Applications. In ACM International Symposium on Software Testing and Analysis.","author":"Nielsen Benjamin Barslev","year":"2021","unstructured":"Benjamin Barslev Nielsen, Martin Toldam Torp, and Anders M\u00f8ller. 2021. Modular Call Graph Construction for Security Scanning of Node.Js Applications. In ACM International Symposium on Software Testing and Analysis."},{"key":"e_1_3_2_2_19_1","volume-title":"International Conference for Internet Technology and Secured Transactions.","author":"Ojamaa Andres","year":"2012","unstructured":"Andres Ojamaa and Karl D\u00fc\u00fcna. 2012. Assessing the security of Node.js platform. In International Conference for Internet Technology and Secured Transactions."},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3582831"},{"key":"e_1_3_2_2_21_1","unstructured":"OWASP. 2022. File Content Validation OWASP . https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/File_Upload_Cheat_Sheet.html#file-content-validation."},{"key":"e_1_3_2_2_22_1","unstructured":"OWASP. 2023. Unrestricted File Upload. https:\/\/owasp.org\/www-community\/vulnerabilities\/Unrestricted_File_Upload."},{"key":"e_1_3_2_2_23_1","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Oz Harun","year":"2023","unstructured":"Harun Oz, Ahmet Aris, Abbas Acar, G\u00fcliz Seray Tuncay, Leonardo Babun, and Selcuk Uluagac. 2023. {R\u00f8B}: Ransomware over Modern Web Browsers. In 32nd USENIX Security Symposium (USENIX Security 23). 7073--7090."},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3514229"},{"key":"e_1_3_2_2_25_1","volume-title":"43rd IEEE Symposium on Security and Privacy (S&P).","author":"Oz Harun","year":"2022","unstructured":"Harun Oz, Faraz Naseem, Ahmet Aris, Abbas Acar, Guliz Seray Tuncay, and A Selcuk Uluagac. 2022. Poster: Feasibility of Malware Visualization Techniques against Adversarial Machine Learning Attacks. In 43rd IEEE Symposium on Security and Privacy (S&P)."},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"crossref","unstructured":"Upasana Sarmah D.K. Bhattacharyya and J.K. Kalita. 2018. A survey of detection methods for XSS attacks. Journal of Network and Computer Applications (2018).","DOI":"10.1016\/j.jnca.2018.06.004"},{"key":"e_1_3_2_2_27_1","unstructured":"Ax Sharma. 2022. NodeJS module downloaded 7M times lets hackers inject code. https:\/\/www.bleepingcomputer.com\/news\/security\/nodejs-moduledownloaded-7m-times-lets-hackers-inject-code\/."},{"key":"e_1_3_2_2_28_1","volume-title":"31st USENIX Security Symposium.","author":"Solomos Konstantinos","year":"2022","unstructured":"Konstantinos Solomos, Panagiotis Ilia, Soroush Karami, Nick Nikiforakis, and Jason Polakis. 2022. The Dangers of Human Touch: Fingerprinting Browser Extensions through User Actions. In 31st USENIX Security Symposium."},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2023.103516"},{"key":"e_1_3_2_2_30_1","volume-title":"Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers. In USENIX Security Symposium.","author":"Staicu Cristian","year":"2018","unstructured":"Cristian Staicu and Michael Pradel. 2018. Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers. In USENIX Security Symposium."},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23071"},{"key":"e_1_3_2_2_32_1","unstructured":"Phil Stokes. 2019. Malicious PDFs. https:\/\/www.sentinelone.com\/blog\/maliciouspdfs-revealing-techniques-behind-attacks\/."},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICITCS.2016.7740334"},{"key":"e_1_3_2_2_34_1","volume-title":"Fix It. In 29th USENIX Security Symposium.","author":"Votipka Daniel","year":"2020","unstructured":"Daniel Votipka, Kelsey R. Fulton, James Parker, Matthew Hou, Michelle L. Mazurek, and Michael Hicks. 2020. Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It. In 29th USENIX Security Symposium."},{"key":"e_1_3_2_2_35_1","volume-title":"USENIX Security Symposium.","author":"Xiao Feng","year":"2021","unstructured":"Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu, and Wenke Lee. 2021. Abusing Hidden Properties to Attack the Node.js Ecosystem. In USENIX Security Symposium."},{"key":"e_1_3_2_2_36_1","volume-title":"28th USENIX Security Symposium.","author":"Zimmermann Markus","year":"2019","unstructured":"Markus Zimmermann, Cristian Staicu, Cam Tenny, and Michael Pradel. 2019. Small World with High Risks: A Study of Security Threats in the npm Ecosystem. In 28th USENIX Security Symposium."}],"event":{"name":"WWW '24: The ACM Web Conference 2024","location":"Singapore Singapore","acronym":"WWW '24","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2024"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645342","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3589334.3645342","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T00:24:59Z","timestamp":1755822299000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645342"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,13]]},"references-count":36,"alternative-id":["10.1145\/3589334.3645342","10.1145\/3589334"],"URL":"https:\/\/doi.org\/10.1145\/3589334.3645342","relation":{},"subject":[],"published":{"date-parts":[[2024,5,13]]},"assertion":[{"value":"2024-05-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}