The '@filename' syntax for uploads has serious security implications

[guzzle]

The '@filename' syntax for uploads has serious security implications

[mtdowling]

It's based off of cURL, so this would be a security hole in just about any PHP script that uses cURL to send POST data. I think an application should sanitize user data before trying to use it.

With that said, I'm not against trying to make sanitizing this data easier-- any suggestions?

[qix]

I wasn't aware of that, and it seems quite open for a couple exploits (very few sites sanitize strings starting with "@").

I would suggest simply leaving out that ability ('files' => array(...) isn't much more work) but since its already present in curl not following suit is a harder argument.

[mtdowling]

I think Guzzle should allow users to send any file they want, and I believe it's the end-developer's responsibility to sanitize user input before sending POST requests.

You've raised a good point though. I've added a note about sanitizing user input in the documentation: http://guzzlephp.org/tour/http.html#post