On older drupal 7 websites I once faced security patches for the webform module, because file upload fields were considered insecure. There was en exploit where people could end up uploading .html files (via ajax) to your files storage and started spamming to those links.
I'm currently working on a drupal 8 project where anonymous users can fill in a form and upload their resume in a file field. I chose to create a content type and a custom form mode. Now the form is shown in a custom controller on the site.
- How (un)safe is the public exposure of a file upload field?
- Are you aware of any steps taken in drupal 8 to further secure this?
- Any suggestions to do this even more securely?
Thanks in advance.