3 ms·

Already on the getting started page I see something that looks almost like possible SQL injection: https://docs.lucee.org/guides/getting-started/first-steps.htm

Already on the getting started page I see something that looks almost like possible SQL injection: https://docs.lucee.org/guides/getting-started/first-steps.html https://docs.lucee.org/guides/getting-started/first-steps.ht... I hope I'm wrong?

dominicr 8y ago
It's not a great example as it's trying to be ultra simple for first steps. There's a lot of built in security to Lucee/CF but for a query I'd always be doubly sure and explicitly state the parameter data type as well and that'll definitely block SQL injections. So this code would be: queryExecute( "select * from employee where id= :itemID" { itemID = { value=arguments.itemID, cfsqltype="cf_sql_varchar", list=true } } );
- bdcravens 8y ago
  That works, though I think most developers are drawn to the markup style <cfquery> (I've been building CFML apps since 1999, and I don't know if I've ever seen queryExecute in the wild)
  - cjcampbell 8y ago
    I've seen both in security reviews, primarily driven by where the code fits in the application. The more modern apps that I've come across (with stronger coding standards) restrict tag-based code to view templates.
rmason 8y ago
Sometimes things get simplified in tutorials. Best practice in CF is to use cfqueryparam: SELECT * FROM #strDatabasePrefix#_courses WHERE intCourseID = <cfqueryparam value = #intCourseID# CFSQLType = "CF_SQL_INTEGER"> You would also want to protect your input variables so that you only get what you're expecting. There's also a free service called HackMyCF that lets you check your server after you've hardened it with the guide that comes with both Lucee and Adobe CF. https://foundeo.com/hack-my-cf/ https://foundeo.com/hack-my-cf/
- jarym 8y ago
  > Sometimes things get simplified in tutorials That’s putting it nicely. What’s happened is you’re showing users the wrong way to do something without it being explicitly clear to them. Then we wonder why people write crap code... My view is NEVER simplify an example to the point it becomes a security or performance hazard. What this tells me now is that this projects examples are not useable, their agenda is to make things appear easy when in fact concrete examples may not be.
  - abraham_lincoln 8y ago
    I am quite certain, regardless of language, a good developer would be aware that input for a DB needs to be sanitized.
    - hobofan 8y ago
      And what about all the none-"good" developers? There are also frameworks that do the sanitization for you (e.g. Rails IIRC), and novice developers coming from those certainly might not be aware.
    - jarym 8y ago
      Equally, one could argue a 'good' developer would not in any way be put off by an example that demonstrated good security practice. And 'good' needs to be put in context: e.g. a 'good' hardware or kernel engineer who never wrote front-end stuff may legitimately be unaware of the need to defend against SQL injection unless its written somewhere. If they're as 'good' as you're expecting they would probably not even require a getting started tutorial... Anyway, this is something I see in many tutorials and its somewhat unfair to single out Lucee. I just wish tutorial writers would put effort into real-world examples more often.

dominicr 8y ago

It's not a great example as it's trying to be ultra simple for first steps. There's a lot of built in security to Lucee/CF but for a query I'd always be doubly sure and explicitly state the parameter data type as well and that'll definitely block SQL injections. So this code would be: queryExecute( "select * from employee where id= :itemID" { itemID = { value=arguments.itemID, cfsqltype="cf_sql_varchar", list=true } } );

bdcravens 8y ago
That works, though I think most developers are drawn to the markup style <cfquery> (I've been building CFML apps since 1999, and I don't know if I've ever seen queryExecute in the wild)
- cjcampbell 8y ago
  I've seen both in security reviews, primarily driven by where the code fits in the application. The more modern apps that I've come across (with stronger coding standards) restrict tag-based code to view templates.

rmason 8y ago

Sometimes things get simplified in tutorials. Best practice in CF is to use cfqueryparam: SELECT * FROM #strDatabasePrefix#_courses WHERE intCourseID = <cfqueryparam value = #intCourseID# CFSQLType = "CF_SQL_INTEGER"> You would also want to protect your input variables so that you only get what you're expecting. There's also a free service called HackMyCF that lets you check your server after you've hardened it with the guide that comes with both Lucee and Adobe CF. https://foundeo.com/hack-my-cf/ https://foundeo.com/hack-my-cf/

jarym 8y ago
> Sometimes things get simplified in tutorials That’s putting it nicely. What’s happened is you’re showing users the wrong way to do something without it being explicitly clear to them. Then we wonder why people write crap code... My view is NEVER simplify an example to the point it becomes a security or performance hazard. What this tells me now is that this projects examples are not useable, their agenda is to make things appear easy when in fact concrete examples may not be.
- abraham_lincoln 8y ago
  I am quite certain, regardless of language, a good developer would be aware that input for a DB needs to be sanitized.
  - hobofan 8y ago
    And what about all the none-"good" developers? There are also frameworks that do the sanitization for you (e.g. Rails IIRC), and novice developers coming from those certainly might not be aware.
  - jarym 8y ago
    Equally, one could argue a 'good' developer would not in any way be put off by an example that demonstrated good security practice. And 'good' needs to be put in context: e.g. a 'good' hardware or kernel engineer who never wrote front-end stuff may legitimately be unaware of the need to defend against SQL injection unless its written somewhere. If they're as 'good' as you're expecting they would probably not even require a getting started tutorial... Anyway, this is something I see in many tutorials and its somewhat unfair to single out Lucee. I just wish tutorial writers would put effort into real-world examples more often.