News for hackers. Stuff that matters.

A comment on Naughty Strings: A list of strings likely to cause issues as user-input data. Parent comment

Re:Naughty Strings: A list of strings likely to cause issues... by FabHK on Sunday January 15, 2017 @05:23PM (#13406727)
SQL injections are in there, and server injections as well.

For example (I trust HN is suitably hardened :-) :

  /dev/null; touch /tmp/blns.fail ; echo
  1;DROP TABLE users
Edit: PS: "Feel free to send a pull request to add more strings, or additional sections."
[ Parent | on HN ]
Re:Naughty Strings: A list of strings likely to cause issues... by inopinatus on Sunday January 15, 2017 @07:22PM (#13407403)
I noticed earlier in the file that the Javascript had been chosen to be benign. "DROP TABLE users" doesn't seem to fit with that spirit. I'd want it to be instantly evident but also non-destructive, or at least reversible. How about renaming the table instead?

(Sure, people generally shouldn't use this test input outside of a discardable testing environment, but if we could rely on "People shouldn't..." clauses to govern behaviour then much of this list would be unnecessary anyway.)

[ Parent | on HN ]
Re:Naughty Strings: A list of strings likely to cause issues... by Arnavion on Sunday January 15, 2017 @08:11PM (#13407589)
Already an issue: https://github.com/minimaxir/big-list-of-naughty-strings/iss...
[ Parent | on HN ]
Re:Naughty Strings: A list of strings likely to cause issues... by schlowmo on Sunday January 15, 2017 @09:26PM (#13407870)
Comment by the reporter of that issue (ro31337):

> "Dropping a table is like checking a gun without bullets. It should not work, but just don't put it against your head while testing."

[ Parent | on HN ]
Re:Naughty Strings: A list of strings likely to cause issues... by Zak on Monday January 16, 2017 @06:49AM (#13409474)
I trust HN is suitably hardened

HN doesn't use a database.

[ Parent | on HN ]
Re:Naughty Strings: A list of strings likely to cause issues... by mrskeltal on Monday January 16, 2017 @06:55AM (#13409494)
How does it store comments?
[ Parent | on HN ]
Re:Naughty Strings: A list of strings likely to cause issues... by Zak on Monday January 16, 2017 @09:20AM (#13410079)
As files on disk. An old version is open source, available from http://arclanguage.org/install

It's written in Arc though, so it may take some effort to read.

[ Parent | on HN ]