GitHub Enterprise SQL Injection

Re:GitHub Enterprise SQL Injection by grey-area on Sunday January 08, 2017 @03:25AM (#13348882)

This is probably incredibly common for things like order params in many web apps and also relies on silly conversion rules in MySQL. Any time you see order=name in params you should be suspicious. Better to use numeric enums. There are similar problems with column names, this site has some great examples which apply to many ohms, not just rails:

http://rails-sqli.org

The lesson is you should always strongly assert the type of user input (where you can, convert to known good values which is even better), and never magically convert types as rails/ MySQL does here. It's less convenient but safer.

[ Parent | on HN ]

Re:GitHub Enterprise SQL Injection by true_religion on Sunday January 08, 2017 @06:38AM (#13349303)

Django for example will throw an error if an ordering parameter does not correspond to a database column.

If you have to specify all the columns of a table in Rails, then ActiveRecord ought to be able to restrict the order params to only column names.

[ Parent | on HN ]

Re:GitHub Enterprise SQL Injection by smithd98 on Sunday January 08, 2017 @08:09AM (#13349552)

I imagine some ORMs don't have this so people can do order by computed columns like "order by assets - liabilities"

To your point it probably makes sense to have an order method that verifies column names and an order_raw method that takes a string so the caller understands the risk, while protecting the usual case.

[ Parent | on HN ]