Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Null

popey.com

Post reply on HN
Print view View original

101–110 of 196 posts

Re: Null

#101

Post by EdwardDiego »

Cyykratahk wrote: post #85
m463 wrote: post #57

Earlier quoted context omitted.

what a great github repo. I enjoyed: # Strings that may occur on IRC clients that make security products freak out DCC SEND STARTKEYLOGGER 0 0 0 and everything under: # Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem)

Found some GitHub issues [1] with something similar: an enterprise firewall blocking a repo because it contained the string "arglebargleglopglyf" [2] in some tests. The text was flagged as malicious because of its presence in the repo github.com/wireghoul/htshells [3]. However, the whole point of the word in the htshells repo is that it's an invalid command that breaks Apache, so it could have been almost any random…

This one from link 3 caught my eye:

    "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read()
Looks to be a Python 2 specific way of trying to read a file in a sneaky way. I say Python 2 specific because Python 3 strings only have 2 supertypes now, so __mro__[2] is out of range, but __mro__[1] is 'object', and I'm guessing they were going for a file like class, but right now object.__subclasses__()[40] points at "mappingproxy".

And the only subclasses of object I can find with a read classmethod are these:

    109 
    110
Found with:

    for i, x in enumerate("".__class__.__mro__[1].__subclasses__()):
        if "read" in dir(x):
            print(str(i) + " " + str(x))

Re: Null

#102

Post by layer8 »

msh wrote: post #28
pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

Why do you require software to be more resilient than other things? If I pour water in the gastank of my car, it will also fail to drive. Or gas in the sprinkler tank. So the car should somehow prevent the enduser putting the wrong thing in the tank?

Because with software you can’t generally predict the consequences, even more so as software tends to not be static, but evolves and starts to interact with more and more other software.

Validate your inputs. Be very careful with in-band special values and escaping syntax. Don’t make any assumptions about what is “reasonable” input. If you have to make assumptions, document them and validate all input for conformance. Always check what requirements and preconditions the code you call has on the values you pass to it. Don’t just make assumptions about it.

Re: Null

#103

Post by kristaps »

Breaking things is far easier than making things. While this type of poking around might feel fun, it will mostly result in low value work to fix something very few (if any) actual users would experience.

Re: Null

#104

Post by gfxgirl »

You should try using the direction changing unicode code points like 0x202E in your name. That will probably break many things.

Re: Null

#105

Post by pvorb »

I experienced the Thunderbird bug mentioned in the article first-hand and freaked out for a moment. "Where does that damn turtle come from?" And had to search quite a bit until I recognized that it was part of the subject. Unfortunately, I no longer have a screenshot of it.

Re: Null

#106

Post by dash2 »

deathanatos wrote: post #10

I worked on an API that regularly got requests from the mobile app for GET /users/(null). I think that's Swift, or Obj-C's way of to-string'ing a null? I have a generational suffix on my name. I often include it, and quite often as the proper Unicode character, e.g., "Ⅲ". (Assuming HN displays it after I post this, try to select it; that's one character.) That wreaks a fair bit of havoc. When I was in high-school, I…

When I lived in the US I was amazed how many systems couldn't handle my (English) surname, which has a dash in it.

Re: Null

#107

Post by slim »

m463 wrote: post #97
scoutt wrote: post #77

Earlier quoted context omitted.

I can get why testing for "Jimmy Clitheroe" and "Horniman Museum" , but can't make a reason for "Linda Callahan" .

In February 2006, Linda Callahan was initially prevented from registering her name with Yahoo! as an e-mail address as it contained the substring Allah. Yahoo! later reversed the ban. https://en.wikipedia.org/wiki/Scunthorpe_problem

that was unexpected. but I guess I should have expected it given how much islam is iconoclastic. it's probably muslims protesting the use of the name of allah in email addresses that caused it (alternate explanation: the word was raising too much false positives in Xkeyscore)

Re: Null

#108

Post by xeeeeeeeeeeenu »

Tepix wrote: post #24

Perl 5 has a taint mode built into the language. If enabled, it forces the developer to untaint every bit of user-controllable data (by running it through a pattern match) before doing anything dangerous with it. I can't believe that this isn't a standard feature in all languages.

Taint mode is a terrible misfeature and modern code should not use it. It's one of those things that makes people think "it's annoying and makes me do additional work so surely it improves the security". No, it doesn't.

For those who are unware what taint mode exactly is: when it's enabled, a string may have a hidden "tainted" flag. Passing a tainted string to many (but not all) built-in functions will result in an exception. Many built-ins return tainted strings, additionally all strings in @ARGV (cli parameters) and %ENV (env variables) are tainted. You can get an untainted string by accessing a tainted string through a regex capture group ($1, $2 etc.). Taint mode is global, so it affects everything, including third party modules.

You may ask "how do I even validate my environmental variables? What's the difference between valid and invalid PATH?". Well, you can't. That's why programs using taint mode are often littered with code like:

    my($untainted) = $foo =~ /^(.*)$/
The worst thing is that you never know whether a function from a third party (CPAN?) module will return a tainted string or not. It may differ between platforms! For example, File::Spec is sometimes returning tainted strings on unixes, but not on Windows (or the other way around, I'm not sure!). In practice that means you will have to run your program, check if it throws an exception, and if it does, you have to use the above no-op "validation" regex.

Well, that assumes that the said third party code works in taint mode. If it wasn't tested with it, it's possible that it won't work at all and there's nothing you can do about it.

Re: Null

#109

Post by dpmdpm »

Reminds me of the first time my DnD group tried out roll20.net. The chat box allows players to type things like "/roll 1d6" or "/roll 2d12" to simulate rolling dice (in these cases 1 6-sided die and 2 12-sided dice). I quickly tried "/roll 1dNaN", crashed the chat, and we went back to physical dice for the rest of the session.

Re: Null

#110

Post by bregma »

martijnvds wrote: post #37
msh wrote: post #28

Earlier quoted context omitted.

Why do you require software to be more resilient than other things? If I pour water in the gastank of my car, it will also fail to drive. Or gas in the sprinkler tank. So the car should somehow prevent the enduser putting the wrong thing in the tank?

Pumps for different types of fuel have differently shaped nozzles here, making it very hard/impossible to fill up with the wrong kind. Of course if you're trying to break it, everything is possible.

Sugar is a fuel and it just slides right in to the tank. Try it.
Post reply on HN