3 ms·
Surely if you've resorted to blocking random SQL keywords you've already lost. SQL has a pretty big dialect not to mention arbitrary functions and procedures th
by nijave 3y ago
Surely if you've resorted to blocking random SQL keywords you've already lost. SQL has a pretty big dialect not to mention arbitrary functions and procedures that might exist.
For instance, TRUNCATE isn't even in the list
- selcuka 3y agoIn real world, as a developer you can't control what IT uses for WAF, so you may have to work around it as much as you can. At a previous job the IT set up a spam filter which used a keyword list (dumb attempt anyway), but it also searched the email headers (not only the body). As a result, we weren't able to receive email if one of the SMTP hops was named, say, smtp.essex.company.com.
- jasonjayr 3y agoAh, a clbuttic mistake!
- Too 3y agoIf you work as a developer and can’t do your job because of a dumb pattern matching WAF out of your control, you should find yourself a new job or set up a parallel IT infrastructure.
- thebiss 3y agoThe infamous Scunthorpe problem. https://en.wikipedia.org/wiki/Scunthorpe_problem https://en.wikipedia.org/wiki/Scunthorpe_problem
- threeseed 3y agoWAFs assume that they are protecting the worst type of systems. And so they will block requests containing DROP etc even if the systems they are fronting are perfect.