Password may not contain: select, insert, update, delete, drop
1–10 of 254 posts
Re: Password may not contain: select, insert, update, delete, drop
#2Obligatory meme-y "tell me you're not sanitizing input without telling me". Also not storing hashes of passwords, because then it wouldn't matter what the input is.
Re: Password may not contain: select, insert, update, delete, drop
#3Optimistically, perhaps this requirement stems from an overzealous WAF
Re: Password may not contain: select, insert, update, delete, drop
#4That's fine. I'll just use `truncate` instead.
Re: Password may not contain: select, insert, update, delete, drop
#5Obligatory meme-y "tell me you're not sanitizing input without telling me". Also not storing hashes of passwords, because then it wouldn't matter what the input is.
Actually they do sanitization by blacklisting
"Blacklist sanitizing cleans the input by removing unwelcomed characters such as line breaks, extra white spaces, tabs, &, and tags."
But still this is not a way, input sanitization is bullshit.
Using query parameters, thus inserting raw input into already built abstract syntax tree of SQL query
is the correct solution since SQL injection is about affecting tree composition
Re: Password may not contain: select, insert, update, delete, drop
#6Obligatory meme-y "tell me you're not sanitizing input without telling me". Also not storing hashes of passwords, because then it wouldn't matter what the input is.
Actually they do sanitization by blacklisting "Blacklist sanitizing cleans the input by removing unwelcomed characters such as line breaks, extra white spaces, tabs, &, and tags." But still this is not a way, input sanitization is bullshit. Using query parameters, thus inserting raw input into already built abstract syntax tree of SQL query is the correct solution since SQL injection is about affecting tree compositi…
Parameterized SQL is your friend here.
Re: Password may not contain: select, insert, update, delete, drop
#7Obligatory meme-y "tell me you're not sanitizing input without telling me". Also not storing hashes of passwords, because then it wouldn't matter what the input is.
> Also not storing hashes of passwords, because then it wouldn't matter what the input is.
That only tells you they don't hash the passwords in the client. Likely the protection ("protection") is for the input validation layer, not the password backend itself.
Re: Password may not contain: select, insert, update, delete, drop
#8A few years ago I was working on some app that would use Wordpress API to post stuff. The customers had their own WP installation on various hosting with various "security" features. We had bug reports where posting to the blog failed and would post empty content, this security plugins would scan a big blog post and if it would find something like ".... select from " it would replace that POST parameter with an empty string.
Also seen similar stuff on a customer bug report, where request from our server containing html text inside a json field would get injected with some obfuscated javascript, I could not be sure if it was a "security" plugin or malware.
Re: Password may not contain: select, insert, update, delete, drop
#9Optimistically, perhaps this requirement stems from an overzealous WAF
That, or some poorly architectured "framework" or toolkit.
Others in the comments see this as "proof" that the application has poor security. I don't think we can draw that conclusion. We can, however, draw the conclusion that some part of the stack is poorly implemented.
Re: Password may not contain: select, insert, update, delete, drop
#10Did someone have a Bobby Tables moment?
In Oracle, you can't use a bind variable in setting a password on an account, so SQL injection is a more significant risk. I wrote some JavaScript and pl/sql to address that.