Re:How I bypassed Cloudflare's SQL Injection filter
by grey-area on Friday September 18, 2020 @04:35PM
(#24521623)
Another safety measure worth looking at is always enforcing types for params before using them for anything. So if id is an int parse it to an int first. That way you know no extra data/commands can be in the param.
[ Parent
| on HN ]
Re:How I bypassed Cloudflare's SQL Injection filter
by nkozyra on Friday September 18, 2020 @08:07PM
(#24523186)
You don't need to, though, that's what parameterized queries are for. I'd argue that providing out-of-bounds checks like that will increase the likelihood of someone relying on them down the road.
Re:How I bypassed Cloudflare's SQL Injection filter
by grey-area on Saturday September 19, 2020 @01:39AM
(#24525422)
The boundary for variable parsing should be the edge of your application. Otherwise you can't be sure that your validity checks (for example) are doing what you think they are, or that your sql is doing what you think it is.
As one example of this consider the rails vuln CVE-2013-0156. Lax param parsing and cleaning (or none), can lead to problems like this and even sqli if you meant to accept a string and instead accept something like an array or a symbol.