3 ms·
We had a customer named Echo. He couldn't make a payment because our credit card processor looked for common Unix shell commands and filtered them out. I thin
by chiph 10y ago
We had a customer named Echo. He couldn't make a payment because our credit card processor looked for common Unix shell commands and filtered them out. I think we ended up creating a discount code just for him so that he'd get the item for free to make up for the annoyance (zero amount due meant no call to the card company).
- david-given 10y ago...filtering out... common Unix commands? By the credit card processor? I would ask 'why', but every time my brain goes there it comes up with terrible, terrible scenarios that I just don't want to think about.
- masklinn 10y agoDo you mean you're not supposed to have a system(3) call with a command built by concatenating user-provided strings as part of your validation process?
- david-given 10y agoDON'T WANT TO THINK ABOUT.
- chiph 10y agoTheir explanation was that someone could send them a command line and it might could get executed (like a SQL injection), so they disallowed them pretty early in their processing to prevent it from happening. Is this likely? I'm sure someone has tried it at some point. And an excess of caution is something that I sort of want in a card processor.
- dalke 10y agoBut why only the common unix commands? I can't think of a level of caution where filtering 'echo' is appropriate but, filtering a more obscure command, perhaps 'dc', is not. An excess of caution would be to put the process in its own chroot'ed jail, with only the bare minimum of tools for needed functionality. And '/bin/echo' is not one of those tools.
- detaro 10y agoProbably because they use a web application firewall that's full of strange rules to try to protect any random crappy application behind it.