5 ms·
Yeah, I hope this is paired with something that actually stops those statements from running otherwise this is a pretty naive way to do this.
by p1necone 3y ago
Yeah, I hope this is paired with something that actually stops those statements from running otherwise this is a pretty naive way to do this.
- DaiPlusPlus 3y agoSQL injection meets prompt-injection…
- calcsam 3y agoCouldn’t you solve this simply by executing from a user without these permissions?
- newaccount74 3y agoSure, but it's something that the customer has to do. I wouldn't rely on customers to configure everything correctly, especially if there is no way to discover the configuration error before the damage has been done.
- panarky 3y agoNEVER CREATE CARTESIAN PRODUCTS For example: SELECT clicks.session_id, clicks.page_url, sessions.user_id FROM clicks, sessions; (This context is guaranteed to generate lots of cartesian products.)
- ainesh93 3y agoYes, opening the connection to the DB read-only would also work. That's what we're planning on doing.