Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

351–360 of 463 posts

Re: I Went to SQL Injection Court

#351

Post by dataflow »

AdamJacobMuller wrote: post #307
dataflow wrote: post #194

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

> And I don't think I disagree with the court on schema vs. file layouts either. I disagree that the law should prohibit disclosing "file layouts" but it's pretty clear that the law does block that, and I fundamentally agree with you that schemas are directly analogous to file layouts and thus restricted.

>> And I don't think I disagree with the court on schema vs. file layouts either.

> I disagree that the law should prohibit disclosing "file layouts"

Note, the court wasn't ruling what the law should say, only what the law says. At least that's my understanding of it. I certainly wasn't opining on what the law should say.

Re: I Went to SQL Injection Court

#352

Post by thaumasiotes »

NoboruWataya wrote: post #238
Y_Y wrote: post #62

Earlier quoted context omitted.

Of course I can't disagree that it's good that it's now settled. Still I can't help but imagine a world where the meaning, at least in terms of which words apply to which others (rather than qualifiers like "reasonable"), should be settled before the law is debated, voted on, and passed. Even (some) programmers have learnt the dangers of parsing at run time (e.g. "eval is evil"). How can we decide it's the law we wan…

> How can we decide it's the law we want if we don't know what it means yet? FWIW, judicial interpretation of legislation is generally seen as an exercise in figuring out what the legislature meant. Courts start by looking at the "plain meaning" of the words used, but where that doesn't yield an unambiguous answer they will often look at the overall scheme or purpose of the legislation to try and figure out which int…

> Courts start by looking at the "plain meaning" of the words used, but where that doesn't yield an unambiguous answer they will often look at the overall scheme or purpose of the legislation to try and figure out which interpretation is most consistent with that.

There is also the concept of a "canon of construction", which exists specifically to handle these kinds of reoccurring grammatical issues. I'm surprised there isn't one for dangling modifiers.

Re: I Went to SQL Injection Court

#353

Post by dataflow »

IshKebab wrote: post #340
valenterry wrote: post #300

Earlier quoted context omitted.

If you do it wrong, yes. Sure, there is no 100% security, but honestly, it's 2025. We already know the techniques how to prevent SQL injection of any kind. I wrote about this here: https://valentin.willscher.de/posts/sql-api/

Right but the case that is being imagined here is a site that perfectly sanitises * but somehow still allows SQL injection? I don't think so.

> Right but the case that is being imagined here is a site that perfectly sanitises * but somehow still allows SQL injection? I don't think so.

It could literally just reject anything with asterisks.

It doesn't even need to do anything perfectly, it just needs to do it enough to produce hurdles for you. Like blowing through the number of attempts you realistically have remaining.

Re: I Went to SQL Injection Court

#354

Post by dataflow »

IshKebab wrote: post #339
dataflow wrote: post #223

Earlier quoted context omitted.

This fails if either the UI sanitizes wildcards, or if the database prohibits them, or if it produces so much data that you can't ingest it in time, etc.

There are trivial ways around all of those. `LIMIT 1`, `SELECT .. FROM information_schema...`, etc.

> There are trivial ways around all of those. `LIMIT 1`

LIMIT 1 limits row count. The issue here was columns. Like a giant blob someone might've stored in there.

> `SELECT .. FROM information_schema...`

no such table: information_schema.columns

> etc.

https://news.ycombinator.com/item?id=43181799

Re: I Went to SQL Injection Court

#355

Post by zettabomb »

layoric wrote: post #132
hn_user82179 wrote: post #115

Earlier quoted context omitted.

This older post was such a fantastic read, thanks for sharing your story!

It's dated from ~2 weeks ago... is there other date information I am missing?

The HN post [0] is from February 9th, 2025, but the post the person you replied to was referencing [1] is from October 19th, 2018.

[0] https://sockpuppet.org/blog/2025/02/09/fixing-illinois-foia/ [1] https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Re: I Went to SQL Injection Court

#356

Post by Y_Y »

manquer wrote: post #150
EMIRELADERO wrote: post #95

Am I the only one slightly perplexed/worried by the point-blank source code exemption? It's easy to imagine a scenario where the city decides to develop a specific software in-house and hide the "biases" in the source code, or any other thing one might not find desirable. Hell, they don't even need to make everything from scratch! Could just patch and use a permissively licensed 3rd-party component. In my opinion, th…

It shouldn't be surprising ? It is the same problem people trying to open sourcing closed projects experience, there is all sorts of locked-in proprietary code which the developer and the customer only have the license to use but not share the source. Even projects which from day one are staunchly open and built without direct commercial interests like government contractors need also suffer from this. The Linux kern…

Maybe FOIA should trump licensing in this case. Suppose I write a manual on how to issue bad parking tickets and hide them in a database, and then license that (in since restrictive manner) to the state of Illinois. I think the public's right to see that document is more important than my right to prevent copying and dissemination.

Re: I Went to SQL Injection Court

#357

Post by lyu07282 »

dataflow wrote: post #347
tczMUFlmoNk wrote: post #217

Earlier quoted context omitted.

You can always `SELECT table_name, column_name, data_type FROM information_schema.columns`, which is part of the SQL standard. https://www.postgresql.org/docs/current/infoschema-columns.h... Plus, generally if you have SQL injection, you have multiple tries. You're not going to be locked out after one shot. And there's only so many combinations of `SELECT {id,userid,user_id,uid} FROM {user,users,login,logins,customer…

> You can always `SELECT table_name, column_name, data_type FROM information_schema.columns`, which is part of the SQL standard. https://www.postgresql.org/docs/current/infoschema-columns.h . You can "always" do that? Well I just did that. My database said: no such table: information_schema.columns And what if my database had disabled this capability entirely? Also, is there anything implying SQL here at all? Can't o…

> You can "always" do that? Well I just did that. My database said: no such table: information_schema.columns

Don't expect attackers to give up after one try. It depends on the database software, not everyone implements this exact ANSI standard for reflection but every database supports reflection. That's why the first step after finding a SQLi is to fingerprint the database software and go from there.

> And what if my database had disabled this capability entirely?

You can't disable it, lots of software, database features, ORMs and clients rely on reflection. If a client can query a table they also can retrieve metadata about that table.

Re: I Went to SQL Injection Court

#358

Post by qingcharles »

dragonwriter wrote: post #284
qingcharles wrote: post #277

Earlier quoted context omitted.

Public bodies tend to just want to resist FOIAs for the sake of resisting them. I've never really been able to fully understand the motivations, even after a decade of FOIA litigation.

I think it is likely to ne about budgets. That is, sure, FOIA and similar state laws usually allow the agency to collect something related to actual costs, but that's mostly meaningless since even if actually covers staff time it doesn't retroactively give them staff to cover it in the impacts areas, and often the FOIA volume doesn't effectively feedback into legislative budget processes for future staffing either, w…

In my experience (and probably in Matt's) this has 100% not been the issue. The people responsible for the FOIA responses aren't in any way connected to budgeting or resources. It is just a body-wide personality issue. Some aspect of maliciousness mixed with laziness... or something.

Re: I Went to SQL Injection Court

#359

Post by underdeserver »

tptacek wrote: post #295
hunter2_ wrote: post #290

Earlier quoted context omitted.

It still seems like a massively gray area: despite the distinction between "would jeopardize" and "could jeopardize" as explained by TFA, the definition of "jeopardize" includes "danger" which means "could lead to harm" not "would lead to harm" at which point it hardly matters whether a thing "could endanger" or "would endanger" the security of the system.

"Would" versus "could" has nothing to do with why your analysis doesn't hold. If something doesn't enable people to attack a system, but is merely one of the valuable things you could get from that system, it does not jeopardize that system under Illinois law. The standard of proof for the jeopardy doesn't enter into it, because no claim of jeopardy has been made. Again: this part of the case is settled. We didn't lo…

How is it that this wording stuff isn't already decided globally? I mean, the concept of dangling modifier has existing for centuries, do the courts really decide this kind of thing on a case-by-case basis by random dice roll?
Post reply on HN