Nice to hear about issues that got actually fixed. I tend to find some edge case issues regularly too, but usually most of bug reports end up in limbo.
Null
151–160 of 196 posts
Re: Null
#152I worked on an API that regularly got requests from the mobile app for GET /users/(null). I think that's Swift, or Obj-C's way of to-string'ing a null? I have a generational suffix on my name. I often include it, and quite often as the proper Unicode character, e.g., "Ⅲ". (Assuming HN displays it after I post this, try to select it; that's one character.) That wreaks a fair bit of havoc. When I was in high-school, I…
'Just today, Azure's support system can't handle (among many things) the outlandish characters of "".'
My favorite way of breaking things is to go the other way... oh, you won't allow ? Well, how about ＜ and ＞? That's ok then? Great!
One I've done several times is encounter a field that "can't be left empty", and is smart enough to filter out the ASCII whitespace before the check... but isn't smart enough to filter out the Unicode zero-width space. "A computer wizard never says too much or too little, he says precisely what he means to."
Re: Null
#153I know finding bugs is undeniably a good thing but I can't help but feel someone as obviously bright as this should be making more things It's like the people who spent a lot of their time finding ever more pedantic inaccuracies and continuity errors in films. The mute LED on your thinkpad sometimes goes out of sync? fascinating
This could allow a malicious party to trick the user into thinking it's microphone is not recording while it actually is.
If this action can be performed using the hardware button it is likely that it can also be performed software-wise, it would be a nice addition for malicious software such as malware.
Re: Null
#154People like that is the reason why this list was created https://github.com/minimaxir/big-list-of-naughty-strings/blo... My personal favorite is this one though "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.",
I am surprised that the EICAR test string is not here:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Re: Null
#155Earlier quoted context omitted.
> But yes, all strings are truthy. Except an empty string! And maybe some little-used nullish characters? Doubtful, but... Or "0"
But not in PHP 8
They changed a lot of the weirder string conversion stuff in PHP 8, but I'm pretty sure "0" is still falsy.
Re: Null
#156Earlier quoted context omitted.
This one from link 3 caught my eye: "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() Looks to be a Python 2 specific way of trying to read a file in a sneaky way. I say Python 2 specific because Python 3 strings only have 2 supertypes now, so __mro__[2] is out of range, but __mro__[1] is 'object', and I'm guessing they were going for a file like class, but right now object.__subclasses__()[40] point…
FWIW it’s looking for the `file` class which does not exist anymore an was a direct subclass of object: `open` now creates a TextIOWrapper >. You can still reach TextIO though _IOBase, in python 3.9 it’s object’s 101st subclass, then 0, then 0. In 3.8 it’s 99, 0, 0.
This is pretty fascinating!
It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string.
Someone in this thread posted a solution with next() that iterates over subclasses to find the correct one. But an injection with spaces won't work as well when injected in jinja2 (something that original injection accomplishes in python2).
Re: Null
#157Earlier quoted context omitted.
In February 2006, Linda Callahan was initially prevented from registering her name with Yahoo! as an e-mail address as it contained the substring Allah. Yahoo! later reversed the ban. https://en.wikipedia.org/wiki/Scunthorpe_problem
that was unexpected. but I guess I should have expected it given how much islam is iconoclastic. it's probably muslims protesting the use of the name of allah in email addresses that caused it (alternate explanation: the word was raising too much false positives in Xkeyscore)
1. That’s not what iconoclastic means. If you actually care about iconoclasm in Islam, the Saudi government has unfortunately destroyed almost 90% of Muslim holy sites without a word from other countries.
2. The Second Commandment Christians follow is “Thou shalt not take the name of the Lord thy God in vain” and I can tell you a lot of Christians follow that.
3. You have it backwards. It’s not Muslims’ fear of the name of God, it’s Yahoo’s fear of literally just the Arabic word for “God.”
Re: Null
#158There was and still is a website called The Daily WTF about discussing especially funny bugs and programmer's mistakes. In 2012 I registered on it as a user "undefined" to make a comment about JavaScript oddities under one of their articles and almost forgot about its existence, then they migrated their comments and forums to Discourse and in 2015 I got a bunch of email notifications about people mentioning me as suddenly all "likes" in the forum were linked to my profile:
https://what.thedailywtf.com/topic/17637/undefined-liked-thi...
Re: Null
#159I know finding bugs is undeniably a good thing but I can't help but feel someone as obviously bright as this should be making more things It's like the people who spent a lot of their time finding ever more pedantic inaccuracies and continuity errors in films. The mute LED on your thinkpad sometimes goes out of sync? fascinating
Since the mute LED is a user-facing security feature, it is in fact a pretty serious bug if users can't rely on it to be correct. Witness the wide variety of incidents over the last year where people ended up in serious trouble because they thought they were muted but weren't.
I feel like of all the examples in the blog post, this was the one with by far the biggest potential for actual harm to people.
Re: Null
#160People like that is the reason why this list was created https://github.com/minimaxir/big-list-of-naughty-strings/blo... My personal favorite is this one though "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.",
I am surprised that the EICAR test string is not here: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* https://en.wikipedia.org/wiki/EICAR_test_file
From README —
Likewise, please do not send pull requests which compromise manual usability of the file. This includes the [EICAR test string](https://en.wikipedia.org/wiki/EICAR_test_file), which can cause the file to be flagged by antivirus scanners, and files which alter the encoding of `blns.txt`. Also, do not send a null character (U+0000) string, as it [changes the file format on GitHub to binary](http://stackoverflow.com/a/19723302) and renders it unreadable in pull requests. Finally, when adding or removing a string please update all files when you perform a pull request.