3 ms·
It still fascinates me why people take human-focused formats (SQL, shell commands in one line) and use them in automated programs. If we'd used application-focu
by deepsun 5y ago
It still fascinates me why people take human-focused formats (SQL, shell commands in one line) and use them in automated programs. If we'd used application-focused formats, there would be much less room for injections. E.g. MsgPack for SQL statements. If a program does not interpret shell commands, but composes raw ["program", "argument"] and runs it, there's no room for sh-injections.
Same can be said for HTML (it was designed for human writing/reading), but it's too late to change that. But SQL and shell commands can be fixed today in application access.
- defanor 5y ago> It still fascinates me why people take human-focused formats (SQL, shell commands in one line) and use them in automated programs. I tend to assume that it happens because it is what's available, and possibly easier (at least in some cases, but then the lowest common denominator wins). Unintended and not quite appropriate use of technologies in general seems to often happen that way. > Same can be said for HTML (it was designed for human writing/reading), but it's too late to change that. But SQL and shell commands can be fixed today in application access. Well, HTML 5 includes the XML-based syntax, which is quite machine-friendly. And for running programs one can indeed skip a shell and just run it with provided arguments and environment variables when it's done programmatically. While to SQL there's usually no alternatives in relational databases. Though I think even SQL isn't inherently bad: a complete, specified, and sensible grammar, together with a proper parser, would allow sane composition and processing, and exclude the bugs such as this one.
- rini17 5y agoThe root problem is programming languages don't have the symbolic facilities to construct SQL statement safely, or they are incredibly awkward. Distinguishing keywords, parameters and table names at source code level would allow for strict version of SQL with simple unambiguous syntax throughout. But nope, let's just concatenate some strings.