5 ms·

Nice to see Bobby Tables is all grown up. Relevant discussion on the Companies House Developer Forum: https://forum.aws.chdev.org/t/cross-site-scripting-xss-s

by jsty 6y ago

Nice to see Bobby Tables is all grown up. Relevant discussion on the Companies House Developer Forum: https://forum.aws.chdev.org/t/cross-site-scripting-xss-software-attack/3355 https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...

ben_w 6y ago
Bobby Tables would be https://find-and-update.company-information.service.gov.uk/company/SC656788 https://find-and-update.company-information.service.gov.uk/c... Not to be confused with the equally inspired https://find-and-update.company-information.service.gov.uk/company/10542519 https://find-and-update.company-information.service.gov.uk/c...
- dilly_bar 6y ago
  Hilarious!
- entrep 6y ago
  Not many DBMS which support stacked queries I'll guess.
- tcgv 6y ago
  I was wondering how much it costs to open a company in the UK to do something like that, and it seems to be really cheap (and quick): a) Incorporate directly via Companies House The standard registration fee to set up a company is just £12 for the ‘standard’ Companies House web incorporation service, which takes up to 24 hours to turnaround. You can pay via credit card, debit card or PayPal. Source: https://www.itcontracting.com/how-much-limited-company-cost/ https://www.itcontracting.com/how-much-limited-company-cost/
  - pjc50 6y ago
    Yes, it is. Do they still require a minimum of two officers? (Spam warning: if you form a company at your home address, you will be inundated with paper spam for office equipment. Especially from Dell.)
    - ed_elliott_asc 6y ago
      I have a ltd company registered at home and I got sent a pen with the company name engraved on it - nice spam :) I also had a letter telling me I was the beneficiary of a few million dollars which was less useful :)
    - tim333 6y ago
      No. You can do it with one person.
  - gerdesj 6y ago
    It is easy to set up a company in the UK and quite rightly so. If it wasn't then the economy might suffer. Issues such as what that company does after incorporation are another matter.
Nextgrid 6y ago
I'm disappointed that the discussion seems more about debating whether that person acted in good faith or that the law regarding acceptable characters in company names should be changed, as opposed to the bigger concern of why were they not sanitizing company names? Even without intent to insert HTML, characters such as < or > would still break their pages.
ashleyn 6y ago
This reminds me of a story I saw on Reddit once. A man worked for a payment processing firm that didn't sanitize their database inputs at all. One day, they get a new customer called "Select". Absolutely everything stopped working.

by jsty 6y ago

ben_w 6y ago

Bobby Tables would be https://find-and-update.company-information.service.gov.uk/company/SC656788 https://find-and-update.company-information.service.gov.uk/c... Not to be confused with the equally inspired https://find-and-update.company-information.service.gov.uk/company/10542519 https://find-and-update.company-information.service.gov.uk/c...

dilly_bar 6y ago
Hilarious!
entrep 6y ago
Not many DBMS which support stacked queries I'll guess.
tcgv 6y ago
I was wondering how much it costs to open a company in the UK to do something like that, and it seems to be really cheap (and quick): a) Incorporate directly via Companies House The standard registration fee to set up a company is just £12 for the ‘standard’ Companies House web incorporation service, which takes up to 24 hours to turnaround. You can pay via credit card, debit card or PayPal. Source: https://www.itcontracting.com/how-much-limited-company-cost/ https://www.itcontracting.com/how-much-limited-company-cost/
- pjc50 6y ago
  Yes, it is. Do they still require a minimum of two officers? (Spam warning: if you form a company at your home address, you will be inundated with paper spam for office equipment. Especially from Dell.)
  - ed_elliott_asc 6y ago
    I have a ltd company registered at home and I got sent a pen with the company name engraved on it - nice spam :) I also had a letter telling me I was the beneficiary of a few million dollars which was less useful :)
  - tim333 6y ago
    No. You can do it with one person.
- gerdesj 6y ago
  It is easy to set up a company in the UK and quite rightly so. If it wasn't then the economy might suffer. Issues such as what that company does after incorporation are another matter.

Nextgrid 6y ago

I'm disappointed that the discussion seems more about debating whether that person acted in good faith or that the law regarding acceptable characters in company names should be changed, as opposed to the bigger concern of why were they not sanitizing company names? Even without intent to insert HTML, characters such as < or > would still break their pages.

ashleyn 6y ago

This reminds me of a story I saw on Reddit once. A man worked for a payment processing firm that didn't sanitize their database inputs at all. One day, they get a new customer called "Select". Absolutely everything stopped working.