… oblivious?

My dad prefers pepsi and is reasoning is sound.

It’s less sweet and pairs better with lemon, which he adds to his pepsi. It’s less carbonated.

I prefer coke. Extra fizzy. No lemon. Perhaps vanilla 😋

I mean just for the love of God don’t spin up something on your company’s infrastructure that accepts file uploads.

Just don’t.

If you’re reading this and going “well, it’s just internal,” or “well, it doesn’t do much it just accepts this exact file type.” My god. Ask your CISA. And if they’re okay with it, cool. That’s on them.

Unless your whole business is transferring files, don’t. And even then… Don’t.

And if you’re still confused, the answer is to use another company’s infrastructure for this. Use Azure. Use AWS. Use Google cloud or even g suites. Don’t accept that liability. Let the trillionaires do it.

Why give your students a way to get RCE on your institutions servers through anything less than perfect file upload implementation.

For a .tar? I wish you the best…

Instead of that, simplify.

Use unique salts for each assignment per student.

Align hashes with those salts to check the outcome for each students assignment.

Literally have them send you a CTF style sha256 string.

Do it step by step where each step doesn’t depend on the next, grade as a percentage of flags accurately procured.