3 ms·

I am reminded of a Customer's grown up "tribal knowledge" around a long-unsupported custom application. Typically and sadly, the developer used string concaten

I am reminded of a Customer's grown up "tribal knowledge" around a long-unsupported custom application. Typically and sadly, the developer used string concatenation to build queries. Some users figured out (or, perhaps, saw the developer do it) they could abuse "filter" fields in the Win32 thick-client application to get filtering functionality the client otherwise didn't offer. Contrived example: AR aging report doesn't allow for filtering by Customer city. It does allow filtering by Customer name. In the Customer name filter box enter "' OR [City] = 'Boston" to get an AR aging report for only Boston customers. The users had built-up a Word document with various magical incantations to get data they couldn't otherwise get. I was impressed by the ingenuity even though it was all horrifying. (The application ran as the database server's superuser-equivalent with the password hard-coded in the client, so nothing was stop somebody from completely trashing the server. >sigh<)

draw_down 1y ago
Hey, if you can know that your users are not adversarial and are capable of writing queries, I say let 'em! The problem is really in that last bit.
ep103 1y ago
SWIM worked as a PM at a company that decided to redo their UI. They ran into an issue on internal roll out, where they discovered their support team for years had been doing sql injection on a specific form in the UI, in order to run reports on the company's database. They had to stop the roll out, and productionize the support team's (very valid) use cases in order to remove the sql injection form.
wvbdmp 1y ago
>(The application ran as the database server's superuser-equivalent with the password hard-coded in the client I was shocked to find that this seems to be the norm, at least in B2G. Development shops “recommend” it and IT depts are relieved if they can get the invariably batshit arcane on-prem deployments to work at all.

draw_down 1y ago

Hey, if you can know that your users are not adversarial and are capable of writing queries, I say let 'em! The problem is really in that last bit.

ep103 1y ago

SWIM worked as a PM at a company that decided to redo their UI. They ran into an issue on internal roll out, where they discovered their support team for years had been doing sql injection on a specific form in the UI, in order to run reports on the company's database. They had to stop the roll out, and productionize the support team's (very valid) use cases in order to remove the sql injection form.

wvbdmp 1y ago

>(The application ran as the database server's superuser-equivalent with the password hard-coded in the client I was shocked to find that this seems to be the norm, at least in B2G. Development shops “recommend” it and IT depts are relieved if they can get the invariably batshit arcane on-prem deployments to work at all.