That company whose name used to contain HTML script tags Ltd • Hacker News Board

Re: That company whose name used to contain HTML script tags Ltd

#11

Post by ceejayoz » Wed, Oct 28, 2020, 3:57 PM UTC

kalium-xyz wrote: post #9

This is not a prank, its the new Companies house search which still contains some kinks and I assume they had to work around a very specific one here.

My understanding is that the Companies House search is fine, but various third-party consumers of the list might not be.

Re: That company whose name used to contain HTML script tags Ltd

#12

Post by outsidetheparty » Wed, Oct 28, 2020, 4:05 PM UTC

bearbin wrote: post #8

Relevant context: https://twitter.com/zofrex/status/1319286955314614275 Apparently the name used to be \"> LTD

hitting mjt.xss.ht returns this:

/* THIS SUBDOMAIN HAS BEEN BANNED FROM THE XSS HUNTER SERVICE.

WE DO NOT ALLOW ABUSE OF OUR SERVICE, ALL SECURITY TESTING MUST BE AUTHORIZED.

Please use our contact form if you believe this ban was a mistake: https://xsshunter.com/contact */

Re: That company whose name used to contain HTML script tags Ltd

#13

Post by fennecfoxen » Wed, Oct 28, 2020, 4:05 PM UTC

klodolph wrote: post #6

tshanmu wrote: post #5

Would be it interesting to know why the name had to be changed?

Because there are a bunch of companies which do aggregation of information about companies, and not all of them used parameterized SQL queries :-/

This is HTML injection, not SQL.

Re: That company whose name used to contain HTML script tags Ltd

#14

Post by razster » Wed, Oct 28, 2020, 4:12 PM UTC

I registered Be for a small company a long time ago. I thought it was clever. They folded during the tech bubble.

Re: That company whose name used to contain HTML script tags Ltd

#15

Post by jsty » Wed, Oct 28, 2020, 4:12 PM UTC

Nice to see Bobby Tables is all grown up.

Relevant discussion on the Companies House Developer Forum:

https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...

Re: That company whose name used to contain HTML script tags Ltd

#16

Post by NullPrefix » Wed, Oct 28, 2020, 4:20 PM UTC

klodolph wrote: post #6

tshanmu wrote: post #5

Would be it interesting to know why the name had to be changed?

Because there are a bunch of companies which do aggregation of information about companies, and not all of them used parameterized SQL queries :-/

And who's problem is that?

Re: That company whose name used to contain HTML script tags Ltd

#17

Post by mathieuh » Wed, Oct 28, 2020, 4:23 PM UTC

Is Companies House's website not done by GDS or something? I worked on a few GDS projects for DFT, we had to have independent pen testers test our services before they moved between phases.

Re: That company whose name used to contain HTML script tags Ltd

#18

Post by hliyan » Wed, Oct 28, 2020, 4:24 PM UTC

On a related topic, the name of the company I work for starts with a colon. The rest of the name is a common adjective. As you can imagine, it is virtually ungooglable at the moment. Any thoughts on how to get around this?

Re: That company whose name used to contain HTML script tags Ltd

#19

Post by Someone1234 » Wed, Oct 28, 2020, 4:26 PM UTC

mathieuh wrote: post #17

Is Companies House's website not done by GDS or something? I worked on a few GDS projects for DFT, we had to have independent pen testers test our services before they moved between phases.

Companies House wasn't compromised, they warned third parties about potential issues with the underlying data.

Re: That company whose name used to contain HTML script tags Ltd

#20

Post by business007 » Wed, Oct 28, 2020, 4:27 PM UTC

hliyan wrote: post #18

On a related topic, the name of the company I work for starts with a colon. The rest of the name is a common adjective. As you can imagine, it is virtually ungooglable at the moment. Any thoughts on how to get around this?

better find a nickname, like D's community did, using dlang lol otherwise no one could find anything on language googling