7 ms·
I've been on teams building web applications for 14 years and not once have I seen someone simply rip out a query builder like this in production code and repla
by jdxcode 6y ago
I've been on teams building web applications for 14 years and not once have I seen someone simply rip out a query builder like this in production code and replace it with a non-parameterized string—let alone someone with 20+ years of experience.
Accidents and SQL injections happen, usually because of non-obvious query-building but this is a different level.
- 0xy 6y agoIt happened to your employer. You might not have been on the team but this stuff is rife. WhatsApp in particular has made some absolutely rookie-tier security blunders [1]. [1] https://threatpost.com/whatsapp-bug-malicious-code-injection-rce/152578/ https://threatpost.com/whatsapp-bug-malicious-code-injection...
- Cloudef 6y agoWhen swift was still young the only mysql library available for it did the same mistake. The memory safety sure didnt help here... Sure enough i had to roll my own code.
- jdxcode 6y agoWell not all injection vulns deserve this level of scrutiny. I'm not familiar with that vuln, but I don't see how it could be the "same mistake". My guess is there simply wasn't support for parameterization or there was a non-obvious concatenation problem when building the query string—but please correct me if I'm wrong. This instance is novel because the parameterization protection was removed in favor of concatenation and that the vuln is so obvious a first-year CS student wouldn't struggle to identify it.