41–50 of 83 posts
A few requests should randomly fail to force the developer to think about handling errors. :)
Jokes aside… chaos engineering is a big deal right now - this isn’t a terrible idea and might be worthy of a fork.
Earlier quoted context omitted.
Just a heads-up, you might want to take down the example website. Now that it's been posted to HN you might see malicious actors. I also think it's prone to SQL injection at the moment? At least, it's raising a syntax error when inputting an apostrophe.
Yes, don't do this: https://github.com/rehacktive/caffeine/blob/master/database/... "INSERT INTO %v (id, data) VALUES('%v','%v') ON CONFLICT (id) DO UPDATE SET data = '%v'" Use prepared statements and parameters passed to the db driver, not building strings with strings or you are vulnerable to sqli. I'd also avoid using %v anyway when building strings - safer to use a specific type like %d for int.
Earlier quoted context omitted.
Just a heads-up, you might want to take down the example website. Now that it's been posted to HN you might see malicious actors. I also think it's prone to SQL injection at the moment? At least, it's raising a syntax error when inputting an apostrophe.
Yes, don't do this: https://github.com/rehacktive/caffeine/blob/master/database/... "INSERT INTO %v (id, data) VALUES('%v','%v') ON CONFLICT (id) DO UPDATE SET data = '%v'" Use prepared statements and parameters passed to the db driver, not building strings with strings or you are vulnerable to sqli. I'd also avoid using %v anyway when building strings - safer to use a specific type like %d for int.
This is useful. But you can achieve the same results in just a few more steps with Hasura or Supabase and end up with something that is close to production ready.
Yeah, I would probably go hasura if I needed this, but I can see the appeal of something that is a single component you can self host and self understand. Hasura is rock solid, but I will never read through it‘s haskell source or understand how it constructs those extra-clever postgres queries. If I read it right, you don‘t need to configure any schema to use this? You can just POST a user and it will create that typ…
One of the security lessons from the late 1990s and early 2000s is that things like this quickly get hacked. Many developers forget that a service where all security is handled client-side are easy targets for hacking.
Furthermore: In a lot of cases, people will ship prototypes and run their stuff on top of them long after they have outgrown a critical component.
I have tried to write a universal backend... It's possible, but you really have to work in a permissions model from the beginning. What you'll find is that basic read/write/own enables very basic functionality. Unfortunately, to do anything complicated, you will need to write server-side queries that verify that the user is allowed to do what they are trying to do.
Correct me if I'm wrong, as I havent used Postgres in a few years, but doesn't the `json` column in Postgres just store the data as text?
Last I knew, jsonb was much more efficient/performant for queries and storage, while having a very robust api for querying specific properties.
Curious what the reasoning was for using json rather than jsonb.
Earlier quoted context omitted.
Yes, don't do this: https://github.com/rehacktive/caffeine/blob/master/database/... "INSERT INTO %v (id, data) VALUES('%v','%v') ON CONFLICT (id) DO UPDATE SET data = '%v'" Use prepared statements and parameters passed to the db driver, not building strings with strings or you are vulnerable to sqli. I'd also avoid using %v anyway when building strings - safer to use a specific type like %d for int.
You're right of course, but I think the idea of this software is that the user (and, by extension, their input) are trusted.
`"CREATE TABLE IF NOT EXISTS %v ( id text PRIMARY KEY, data json NOT NULL)"` Correct me if I'm wrong, as I havent used Postgres in a few years, but doesn't the `json` column in Postgres just store the data as text? Last I knew, jsonb was much more efficient/performant for queries and storage, while having a very robust api for querying specific properties. Curious what the reasoning was for using json rather than jso…
For this product, if the super-generic API doesn't offer/require a need to do complex operations, though, json may be adequate to lookup items by id and present them.
Earlier quoted context omitted.
Just a heads-up, you might want to take down the example website. Now that it's been posted to HN you might see malicious actors. I also think it's prone to SQL injection at the moment? At least, it's raising a syntax error when inputting an apostrophe.
Yes, don't do this: https://github.com/rehacktive/caffeine/blob/master/database/... "INSERT INTO %v (id, data) VALUES('%v','%v') ON CONFLICT (id) DO UPDATE SET data = '%v'" Use prepared statements and parameters passed to the db driver, not building strings with strings or you are vulnerable to sqli. I'd also avoid using %v anyway when building strings - safer to use a specific type like %d for int.
Earlier quoted context omitted.
Yes, don't do this: https://github.com/rehacktive/caffeine/blob/master/database/... "INSERT INTO %v (id, data) VALUES('%v','%v') ON CONFLICT (id) DO UPDATE SET data = '%v'" Use prepared statements and parameters passed to the db driver, not building strings with strings or you are vulnerable to sqli. I'd also avoid using %v anyway when building strings - safer to use a specific type like %d for int.
the reason I went "quick'n dirty" is for the prototyping nature of the project. But I'll fix this anyway, thanks!