Password may not contain: select, insert, update, delete, drop

Re:Password may not contain: select, insert, update, delete,... by nijave on Sunday January 21, 2024 @07:47PM (#39084727)

Surely if you've resorted to blocking random SQL keywords you've already lost. SQL has a pretty big dialect not to mention arbitrary functions and procedures that might exist.

For instance, TRUNCATE isn't even in the list

[ Parent | on HN ]

Re:Password may not contain: select, insert, update, delete,... by selcuka on Sunday January 21, 2024 @08:09PM (#39084880)

In real world, as a developer you can't control what IT uses for WAF, so you may have to work around it as much as you can.

At a previous job the IT set up a spam filter which used a keyword list (dumb attempt anyway), but it also searched the email headers (not only the body). As a result, we weren't able to receive email if one of the SMTP hops was named, say, smtp.essex.company.com.

[ Parent | on HN ]

Re:Password may not contain: select, insert, update, delete,... by jasonjayr on Sunday January 21, 2024 @09:59PM (#39085643)

Ah, a clbuttic mistake!

[ Parent | on HN ]

Re:Password may not contain: select, insert, update, delete,... by Too on Monday January 22, 2024 @02:19AM (#39087161)

If you work as a developer and can’t do your job because of a dumb pattern matching WAF out of your control, you should find yourself a new job or set up a parallel IT infrastructure.

[ Parent | on HN ]

Re:Password may not contain: select, insert, update, delete,... by thebiss on Tuesday January 23, 2024 @10:01AM (#39104181)

The infamous Scunthorpe problem.

https://en.wikipedia.org/wiki/Scunthorpe_problem

[ Parent | on HN ]

Re:Password may not contain: select, insert, update, delete,... by threeseed on Sunday January 21, 2024 @10:58PM (#39086026)

WAFs assume that they are protecting the worst type of systems.

And so they will block requests containing DROP etc even if the systems they are fronting are perfect.

[ Parent | on HN ]