3 ms·

Looks vulnerable to SQL injection attacks. (https://fortran.io/static/model.html https://fortran.io/static/model.html)

jaywalk 7y ago
I held out hope that maybe there was some sort of special treatment for that parameter. But then I looked at the source and... nope, it's just slapped on the end of the command.
- mapmeld 7y ago
  I couldn't remember, but checked - I am replacing ' with _ in the actual code https://github.com/mapmeld/fortran-machine/blob/master/marsupial.f90#L43 https://github.com/mapmeld/fortran-machine/blob/master/marsu...
  - lotyrin 7y ago
    Generating an SQL string with any input from the user is not accepted best practice, even if that were a sufficient way to achieve it (I suspect it would disallow a parameter string to contain a legitimate, escaped ' character). Generally, it is recommended that you create a prepared statement entirely from static SQL string(s) (no user input) and then bind parameters into it, such that there is no possibility for any user input to be parsed as SQL: https://www.sqlite.org/c3ref/stmt.html https://www.sqlite.org/c3ref/stmt.html
sm4rk0 7y ago
You can report it here https://github.com/mapmeld/fortran-machine/issues https://github.com/mapmeld/fortran-machine/issues
uncle_j 7y ago
If they've haven't got that right I would be sceptical what other insecurities are present.
- NelsonMinar 7y ago
  Yes this brand new Fortran web framework may not be suitable for production use yet.
  - uncle_j 7y ago
    It doesn't say that anywhere on the site or their github page.
    - merijnv 7y ago
      This just in: Most open source is provided as-is and it's up to you to assess it's quality and production readiness.
      - uncle_j 7y ago
        Oh this old chestnut. This is quite frankly nonsense. You have released the software to the wider world it is your responsibility to make sure it is decent. Just because you have released it for free doesn't suddenly mean you can avoid criticism. SQL injection is such a basic thing to check there is really no excuse.

I held out hope that maybe there was some sort of special treatment for that parameter. But then I looked at the source and... nope, it's just slapped on the end of the command.

mapmeld 7y ago
I couldn't remember, but checked - I am replacing ' with _ in the actual code https://github.com/mapmeld/fortran-machine/blob/master/marsupial.f90#L43 https://github.com/mapmeld/fortran-machine/blob/master/marsu...
- lotyrin 7y ago
  Generating an SQL string with any input from the user is not accepted best practice, even if that were a sufficient way to achieve it (I suspect it would disallow a parameter string to contain a legitimate, escaped ' character). Generally, it is recommended that you create a prepared statement entirely from static SQL string(s) (no user input) and then bind parameters into it, such that there is no possibility for any user input to be parsed as SQL: https://www.sqlite.org/c3ref/stmt.html https://www.sqlite.org/c3ref/stmt.html

sm4rk0 7y ago

You can report it here https://github.com/mapmeld/fortran-machine/issues https://github.com/mapmeld/fortran-machine/issues

uncle_j 7y ago

If they've haven't got that right I would be sceptical what other insecurities are present.

NelsonMinar 7y ago
Yes this brand new Fortran web framework may not be suitable for production use yet.
- uncle_j 7y ago
  It doesn't say that anywhere on the site or their github page.
  - merijnv 7y ago
    This just in: Most open source is provided as-is and it's up to you to assess it's quality and production readiness.
    - uncle_j 7y ago
      Oh this old chestnut. This is quite frankly nonsense. You have released the software to the wider world it is your responsibility to make sure it is decent. Just because you have released it for free doesn't suddenly mean you can avoid criticism. SQL injection is such a basic thing to check there is really no excuse.