Naughty Strings: A list of strings likely to cause issues as user-input data

Re:Naughty Strings: A list of strings likely to cause issues... by chiph on Sunday January 15, 2017 @04:38PM (#13406524)

You might want to include common unix shell commands. At a previous job we had a customer with the last name of Echo who wasn't able to make a purchase. Turns out our credit card processor blocked them.

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by mikey_p on Sunday January 15, 2017 @05:57PM (#13406908)

I'm not surprised by that at all. We once had a major issue with an analytics platform that provided a script with JS link tracking for our site, where clicking a link that contained 'cgi-bin' anywhere in the path caused the browser to hang for a long time.

Turns out they were using a synchronous HTTP request with NO timeout, and their intrusion detection system was blackholing any request that contained 'cgi-bin' anywhere in the headers or body.

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by jcl on Monday January 16, 2017 @05:45PM (#13413703)

Yow... Reminds me of the bug on the first Android phone where all keyboard input was also quietly fed to a root prompt, such that you could reboot the phone by typing "<enter>reboot<enter>" at any time. (https://mobile.slashdot.org/story/08/11/08/1720246/bug-in-an...)

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by Normal_gaussian on Sunday January 15, 2017 @05:18PM (#13406715)

Jesus. Which credit card processor? That stinks of bad design.

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by chiph on Sunday January 15, 2017 @09:49PM (#13407937)

Given how often they came under attack, I don't blame them for taking a "belt and suspenders" approach.

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by paulddraper on Monday January 16, 2017 @10:20AM (#13410415)

More like "belt and helium balloons" approach.

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by smnplk on Sunday January 15, 2017 @06:48PM (#13407221)

This is hilarious.

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by 50CNT on Monday January 16, 2017 @03:25AM (#13408806)

Does this mean little bobby tables[0] might have trouble making online purchases?

[0]https://www.xkcd.com/327/

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by lisper on Sunday January 15, 2017 @04:55PM (#13406612)

SQL injections too.

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by FabHK on Sunday January 15, 2017 @05:23PM (#13406727)

SQL injections are in there, and server injections as well.

For example (I trust HN is suitably hardened :-) :

  /dev/null; touch /tmp/blns.fail ; echo
  1;DROP TABLE users

Edit: PS: "Feel free to send a pull request to add more strings, or additional sections."

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by inopinatus on Sunday January 15, 2017 @07:22PM (#13407403)

I noticed earlier in the file that the Javascript had been chosen to be benign. "DROP TABLE users" doesn't seem to fit with that spirit. I'd want it to be instantly evident but also non-destructive, or at least reversible. How about renaming the table instead?

(Sure, people generally shouldn't use this test input outside of a discardable testing environment, but if we could rely on "People shouldn't..." clauses to govern behaviour then much of this list would be unnecessary anyway.)

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by Arnavion on Sunday January 15, 2017 @08:11PM (#13407589)

Already an issue: https://github.com/minimaxir/big-list-of-naughty-strings/iss...

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by schlowmo on Sunday January 15, 2017 @09:26PM (#13407870)

Comment by the reporter of that issue (ro31337):

> "Dropping a table is like checking a gun without bullets. It should not work, but just don't put it against your head while testing."

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by Zak on Monday January 16, 2017 @06:49AM (#13409474)

I trust HN is suitably hardened

HN doesn't use a database.

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by mrskeltal on Monday January 16, 2017 @06:55AM (#13409494)

How does it store comments?

[ Parent | on HN ]

Re:Naughty Strings: A list of strings likely to cause issues... by Zak on Monday January 16, 2017 @09:20AM (#13410079)

As files on disk. An old version is open source, available from http://arclanguage.org/install

It's written in Arc though, so it may take some effort to read.

[ Parent | on HN ]