8 ms·
Is it me or the person that wrote that post has no idea what SQL inject actually is?
by alexandernst 8y ago
Is it me or the person that wrote that post has no idea what SQL inject actually is?
- empath75 8y agoI don’t understand at all what the difference is between the two functions.
- deleted 8y ago[deleted]
- borntyping 8y agoThe second function only accepts strings defined at compile time, meaning it can't be called with strings created at runtime (i.e. any string containing user input).
- empath75 8y agoSo what to you do if you need to make a sql call based on user input?
- gnud 8y agoUse parameters, of course. Using SQL parameters for untrusted input is the only sane way to avoid SQL injections.
- EugeneOZ 8y agojust add "to_owned()" and problem solved. This function doesn't protect nothing, it's a bullshit. I love Rust, but author is far from the theme he is trying to describe. And theme is dangerous enough.
- C4K3 8y agoto_owned() converts to a String, not to a &'static str. Those are not the same. You can't create a &'static str dynamically (though you can mutate one using unsafe.)
- EugeneOZ 8y agolol, so you call your SQL just with constants? "username" in his example just for one user forever? Still a bullshit.
- C4K3 8y agoNo, only the SQL statement has to be 'static. It's not bullshit.
- EugeneOZ 8y agoCan you provide real-world example please?
- Khoth 8y agoFrom TFA: let _rows = sql_query("SELECT * FROM users WHERE username=?", &[username]); The statement is static, but the [username] part is not, it's just a variable that can have whatever username you want.
- EugeneOZ 8y agoand I already told that this example has no meaning, it's just a bullshit - nobody will use it in real app. You want to fetch from db info about the only one user, who's name is a constant? Yeah, all apps do it every day.
- derkha 8y agoYou can convert a `String` into a `&'static str` using only safe stdlib functions via `Box::leak(s.into())`. This uses `unsafe` internally, of course... but so does almost any code.
- C4K3 8y agoAh cool, I hadn't heard about Box::leak until now. Coming to stable in 1.26 it seems.
- kazinator 8y agoThe idea seems to be that if a variable has a certain kind of Rust lifetime, then it contains only trusted data associated with the program itself, rather than some untrusted input. Problem is, that is too limiting to satisfy the functional use cases in a lot of code that constructs SQL queries by substituting values into templates, where some of the pieces are necessarily dependent on inputs from logged-in users and such.
- kpmah 8y agoLooks correct to me. What issue do you have with it? They're saying injection attacks come from dynamically building strings, so if you prevent that you stop the vulnerabilities.
- alexandernst 8y agoSQL Inject is not only a ' character. SQL Inject could be a blind query, subselect attack, time attack and so on and so on. This completely fails to prevent pretty much anything except the very naive and silly attacks.
- charriu 8y agoThis prevents dynamically created queries using lifetimes. It does not search for ' characters.
- swirepe 8y agoYup. But it does it at compile time for basically no work.
- CiPHPerCoder 8y agoNo it doesn't. The argument isn't "block ' characters to stop SQL injection" it's "force the developer to use prepared statements and no dynamically constructed queries".
- coldtea 8y agoFirst, no, it prevents much more attacks. Second, the naive and silly attacks are the default definition of SQL injection -- and the most commonly found holes, so even if it just prevented those that would be still a huge help. Nothing statically ensures that at runtime except the programmer's due diligence.
- microsuck 8y agoAm I just too dumb or is it really impossible for this code to exchange the username?
- deleted 8y ago[deleted]