Re:Every UUID Dot Com
by jiggawatts on Saturday December 07, 2024 @07:22AM
(#42349313)
"We'll just not do business with anyone named O'Neill, that's just a made-up name designed to trick the database with SQL injection."
Are you arguing to just allow any byte in names (which are ultimately user-defined input data), including 0x00, Unicode byte order markers etc., in a thread about a perceived correlation between developers' lack of i18n awareness and security bugs no less?
The reality is that there is often a tradeoff between keeping your test and edge cases simple via constraining allowable inputs and internationalization.
So I think you've got it exactly the wrong way around: These limitations might have happened precisely because somebody wanted to do the right thing from a safety/security perspective by doing overly strict input validation, at the expense of internationalization/compatibility.
Not saying that that's a good tradeoff in every case, but I really don't think you can draw any conclusions about a system's security by looking at whether it arbitrarily disallows some inputs (or if anything, maybe the opposite).
People tend to very very quickly their mind on that one once they get a few right-to-left control characters that flip over the text layout of the entire program.