5 ms·

Interesting. That's the first time I have run across this. Makes sense.

by zikduruqe 3y ago

Jabrov 3y ago
How does that make sense?
- kevindamm 3y ago
  I think they meant "corresponds with behavior observed" not "sounds rational."
crotchfire 3y ago
That does not make sense at all; it is batshit-crazy broken.
- r1ch 3y ago
  Welcome to the world of WAFs. Pattern matching scary strings is big business.
  - cubefox 3y ago
    For the uninitiated: https://www.cloudflare.com/application-services/products/waf/ https://www.cloudflare.com/application-services/products/waf...
    - wslh 3y ago
      Believe me you can find them present in popular sites you use everyday ;-) I caught one of them and reported it.
    - rrr_oh_man 3y ago
      Thanks. For me WAF is https://en.wikipedia.org/wiki/Wife_acceptance_factor https://en.wikipedia.org/wiki/Wife_acceptance_factor since the 2000's era of German audio enthusiast forums
  - refulgentis 3y ago
    what dark magic is this? do you put it in front of all POSTs or something?
    - Uvix 3y ago
      Not just POSTs, but any HTTP request - headers & query strings get inspected too.
- josephcsible 3y ago
  Indeed. WAFs need to die; they're basically all just doing <https://thedailywtf.com/articles/Injection_Rejection https://thedailywtf.com/articles/Injection_Rejection>.
  - bandergirl 3y ago
    That code makes me sick to my chest. Why are some people allergic to reading? <Receives solution> Nah I’m not opening that link, I got it
    - jiggawatts 3y ago
      Even if they got the link, read it, they probably didn't fully understand the concepts. I wish this was a joke, but just last month I spent literally hours arguing with multiple people -- on shore -- that that kind of query rewrite/rejection approach was never going to work properly, and only properly parameterised queries were correct. Nope. Fix after fix, then fixes for the fixes, then workarounds for the glitches, and then... on and on. It was incredible to me that in 2023, supposedly senior technical team leads would have heated arguments rejecting parameterised queries and favouring regex WAF instead.
      - egeozcan 3y ago
        A common problem with technical leads is that occasionally they tend to forget that they can't know all the correct solutions and it's usually better to yield to those who do. Sometimes seniority makes this even worse. Source: After so many years of dealing with bad technical decisions became a TL myself :)
      - Dylan16807 3y ago
        > query rewrite/rejection approach was never going to work properly, and only properly parameterised queries were correct ...what do you mean by "rewrite/rejection"? If rewrite means "escaping strings using the database function designed for that purpose", then that approach works just fine. It's not comparable to rejection at all. If they were making their own version, then the underlying problem is that they were making their own version. Parameterised queries are lovely but they are not the only option.

Interesting. That's the first time I have run across this. Makes sense.

Jabrov 3y ago

How does that make sense?

kevindamm 3y ago
I think they meant "corresponds with behavior observed" not "sounds rational."

crotchfire 3y ago

That does not make sense at all; it is batshit-crazy broken.

r1ch 3y ago
Welcome to the world of WAFs. Pattern matching scary strings is big business.
- cubefox 3y ago
  For the uninitiated: https://www.cloudflare.com/application-services/products/waf/ https://www.cloudflare.com/application-services/products/waf...
  - wslh 3y ago
    Believe me you can find them present in popular sites you use everyday ;-) I caught one of them and reported it.
  - rrr_oh_man 3y ago
    Thanks. For me WAF is https://en.wikipedia.org/wiki/Wife_acceptance_factor https://en.wikipedia.org/wiki/Wife_acceptance_factor since the 2000's era of German audio enthusiast forums
- refulgentis 3y ago
  what dark magic is this? do you put it in front of all POSTs or something?
  - Uvix 3y ago
    Not just POSTs, but any HTTP request - headers & query strings get inspected too.
josephcsible 3y ago
Indeed. WAFs need to die; they're basically all just doing <https://thedailywtf.com/articles/Injection_Rejection https://thedailywtf.com/articles/Injection_Rejection>.
- bandergirl 3y ago
  That code makes me sick to my chest. Why are some people allergic to reading? <Receives solution> Nah I’m not opening that link, I got it
  - jiggawatts 3y ago
    Even if they got the link, read it, they probably didn't fully understand the concepts. I wish this was a joke, but just last month I spent literally hours arguing with multiple people -- on shore -- that that kind of query rewrite/rejection approach was never going to work properly, and only properly parameterised queries were correct. Nope. Fix after fix, then fixes for the fixes, then workarounds for the glitches, and then... on and on. It was incredible to me that in 2023, supposedly senior technical team leads would have heated arguments rejecting parameterised queries and favouring regex WAF instead.
    - egeozcan 3y ago
      A common problem with technical leads is that occasionally they tend to forget that they can't know all the correct solutions and it's usually better to yield to those who do. Sometimes seniority makes this even worse. Source: After so many years of dealing with bad technical decisions became a TL myself :)
    - Dylan16807 3y ago
      > query rewrite/rejection approach was never going to work properly, and only properly parameterised queries were correct ...what do you mean by "rewrite/rejection"? If rewrite means "escaping strings using the database function designed for that purpose", then that approach works just fine. It's not comparable to rejection at all. If they were making their own version, then the underlying problem is that they were making their own version. Parameterised queries are lovely but they are not the only option.