6 ms·

You might want to include common unix shell commands. At a previous job we had a customer with the last name of Echo who wasn't able to make a purchase. Turns

by chiph 10y ago

You might want to include common unix shell commands. At a previous job we had a customer with the last name of Echo who wasn't able to make a purchase. Turns out our credit card processor blocked them.

lisper 10y ago
SQL injections too.
- FabHK 10y ago
  SQL injections are in there, and server injections as well. For example (I trust HN is suitably hardened :-) : /dev/null; touch /tmp/blns.fail ; echo 1;DROP TABLE users Edit: PS: "Feel free to send a pull request to add more strings, or additional sections."
  - inopinatus 10y ago
    I noticed earlier in the file that the Javascript had been chosen to be benign. "DROP TABLE users" doesn't seem to fit with that spirit. I'd want it to be instantly evident but also non-destructive, or at least reversible. How about renaming the table instead? (Sure, people generally shouldn't use this test input outside of a discardable testing environment, but if we could rely on "People shouldn't..." clauses to govern behaviour then much of this list would be unnecessary anyway.)
    - Arnavion 10y ago
      Already an issue: https://github.com/minimaxir/big-list-of-naughty-strings/issues/16 https://github.com/minimaxir/big-list-of-naughty-strings/iss...
      - schlowmo 10y ago
        Comment by the reporter of that issue (ro31337): > "Dropping a table is like checking a gun without bullets. It should not work, but just don't put it against your head while testing."
  - Zak 10y ago
    I trust HN is suitably hardened HN doesn't use a database.
    - mrskeltal 10y ago
      How does it store comments?
      - Zak 10y ago
        As files on disk. An old version is open source, available from http://arclanguage.org/install http://arclanguage.org/install It's written in Arc though, so it may take some effort to read.
Normal_gaussian 10y ago
Jesus. Which credit card processor? That stinks of bad design.
- chiph 10y ago
  Given how often they came under attack, I don't blame them for taking a "belt and suspenders" approach.
  - paulddraper 10y ago
    More like "belt and helium balloons" approach.
mikey_p 10y ago
I'm not surprised by that at all. We once had a major issue with an analytics platform that provided a script with JS link tracking for our site, where clicking a link that contained 'cgi-bin' anywhere in the path caused the browser to hang for a long time. Turns out they were using a synchronous HTTP request with NO timeout, and their intrusion detection system was blackholing any request that contained 'cgi-bin' anywhere in the headers or body.
smnplk 10y ago
This is hilarious.
50CNT 10y ago
Does this mean little bobby tables[0] might have trouble making online purchases? [0]https://www.xkcd.com/327/ https://www.xkcd.com/327/
jcl 10y ago
Yow... Reminds me of the bug on the first Android phone where all keyboard input was also quietly fed to a root prompt, such that you could reboot the phone by typing "<enter>reboot<enter>" at any time. (https://mobile.slashdot.org/story/08/11/08/1720246/bug-in-android-passes-keystrokes-to-root-shell https://mobile.slashdot.org/story/08/11/08/1720246/bug-in-an...)

by chiph 10y ago

lisper 10y ago

SQL injections too.

FabHK 10y ago
SQL injections are in there, and server injections as well. For example (I trust HN is suitably hardened :-) : /dev/null; touch /tmp/blns.fail ; echo 1;DROP TABLE users Edit: PS: "Feel free to send a pull request to add more strings, or additional sections."
- inopinatus 10y ago
  I noticed earlier in the file that the Javascript had been chosen to be benign. "DROP TABLE users" doesn't seem to fit with that spirit. I'd want it to be instantly evident but also non-destructive, or at least reversible. How about renaming the table instead? (Sure, people generally shouldn't use this test input outside of a discardable testing environment, but if we could rely on "People shouldn't..." clauses to govern behaviour then much of this list would be unnecessary anyway.)
  - Arnavion 10y ago
    Already an issue: https://github.com/minimaxir/big-list-of-naughty-strings/issues/16 https://github.com/minimaxir/big-list-of-naughty-strings/iss...
    - schlowmo 10y ago
      Comment by the reporter of that issue (ro31337): > "Dropping a table is like checking a gun without bullets. It should not work, but just don't put it against your head while testing."
- Zak 10y ago
  I trust HN is suitably hardened HN doesn't use a database.
  - mrskeltal 10y ago
    How does it store comments?
    - Zak 10y ago
      As files on disk. An old version is open source, available from http://arclanguage.org/install http://arclanguage.org/install It's written in Arc though, so it may take some effort to read.

Normal_gaussian 10y ago

Jesus. Which credit card processor? That stinks of bad design.

chiph 10y ago
Given how often they came under attack, I don't blame them for taking a "belt and suspenders" approach.
- paulddraper 10y ago
  More like "belt and helium balloons" approach.

mikey_p 10y ago

I'm not surprised by that at all. We once had a major issue with an analytics platform that provided a script with JS link tracking for our site, where clicking a link that contained 'cgi-bin' anywhere in the path caused the browser to hang for a long time. Turns out they were using a synchronous HTTP request with NO timeout, and their intrusion detection system was blackholing any request that contained 'cgi-bin' anywhere in the headers or body.

smnplk 10y ago

This is hilarious.

50CNT 10y ago

Does this mean little bobby tables[0] might have trouble making online purchases? [0]https://www.xkcd.com/327/ https://www.xkcd.com/327/

jcl 10y ago

Yow... Reminds me of the bug on the first Android phone where all keyboard input was also quietly fed to a root prompt, such that you could reboot the phone by typing "<enter>reboot<enter>" at any time. (https://mobile.slashdot.org/story/08/11/08/1720246/bug-in-android-passes-keystrokes-to-root-shell https://mobile.slashdot.org/story/08/11/08/1720246/bug-in-an...)