Re:U.S. Election Agency Breached by Hackers After November Vote
by pvg on Saturday December 24, 2016 @09:48PM
(#13252617)
It's not just PHP. It's too easy to do in many languages. It almost seems odd there isn't a 'libsodium but for DB access' or 'linter that makes your CI server explode on dangerous DB API use'. Things like that don't have to be foolproof but they'd be better than the current anything-goes default.
[ Parent
| on HN ]
Re:U.S. Election Agency Breached by Hackers After November Vote
by int_19h on Sunday December 25, 2016 @05:50AM
(#13253677)
It's easy to do in any language/framework which accepts raw strings as SQL input. Which is pretty much all of them, except for ORMs and similar (and even those usually have an escape hatch, which sufficiently lazy/clueless developers can and will find eventually).
If a raw string is allowed, then the standard facilities - string concatenation, formatting etc - can be used to write injection-vulnerable code.
The only mitigation that does not require educating the end developers is to completely banish strings from the API, and require everything to go through a DSL layer instead. Said layer can then ensure that all values are properly quoted and/or parametrized prepared statements are used as needed.
Re:U.S. Election Agency Breached by Hackers After November Vote
by pvg on Sunday December 25, 2016 @05:53AM
(#13253683)
"Said Leopard to Baviaan (and it was a very hot day), "Where has all the game gone?"
And Baviaan winked. He knew.
Said the Ethiopian to Baviaan, "Can you tell me the present habitat of the aboriginal Fauna?" (That meant just the same thing, but the Ethiopian always used long words. He was a grown-up.)"