10 ms·
Given many of the engineers i have worked with and much more importantly the PMs and Managers that work over them, I would expect vulnerabilities like this to p
by hpoe 5y ago
Given many of the engineers i have worked with and much more importantly the PMs and Managers that work over them, I would expect vulnerabilities like this to proliferate all over the place if people were to roll their own logging and telematry and especially authentication.
I mean SQL injection is such an easy known mitigation yet is still on the OWASP top 10 even after so many years.
- ineedasername 5y agoYes, people still forget to ; delete from comments where id = 29544262 */-- sanitize their inputs. ...still there?
- benhoyt 5y ago> sanitize their inputs. For anyone confused about why "sanitizing your inputs" isn't the right approach, please read (shameless self-promotion, but I think the concept is important): https://benhoyt.com/writings/dont-sanitize-do-escape/ https://benhoyt.com/writings/dont-sanitize-do-escape/
- ineedasername 5y agoI've pretty much always taken 'sanitize' as a catch-all for all of the things you need to do.
- benhoyt 5y agoFair enough on that part. But it's the "their inputs" part that's just as problematic: whatever massaging you do to your "inputs", they'll always be unsafe in some contexts. You need to encode/escape your output.
- mypalmike 5y agoThe humor here is that sanitizing inputs is not the proper mitigation.
- mro_name 5y agobut? It think it's far deeper than mitigation, it's the solution. Edit: I apologize for getting 'sanitation' wrong. Don't do it.
- jdlshore 5y agoThe proper solution to SQL injection is parameterized queries, not input sanitization, to my knowledge.
- drunkpotato 5y agoThe irony here is that if you use the log4j equivalent of parameterized queries, parameterized logging strings, you're still vulnerable to this CVE, even if you did everything right.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- AnotherGoodName 5y agoFor databases you simply parametize the inputs so that code is code and data is data and there's no mixing of the two. Sanitization is a defence of last resort when you simply can't separate code and data. Usually used for user content on the web since HTML has no formal mechanism to separate code and data because the angled brackets that do this separation are also valid user input. But databases do have a way to separate the query from the data. Parametize your queries.
- mro_name 5y agoIndeed. That's enforced system boundaries.
- mro_name 5y agoit's all about system boundaries. Would you have arbitrary racoons in your closet?
- ineedasername 5y agoIt seems like you're saying that I should let the racoons out of my closet. I'll consider it, but then getting my clothes every morning will be a lot less exciting.