4 ms·
As a past practitioner of Big Freaking Enterprise Apps who has seen the sausage get made, and also as someone who has shot his own foot off with telephony APIs,
by patio11 14y ago
As a past practitioner of Big Freaking Enterprise Apps who has seen the sausage get made, and also as someone who has shot his own foot off with telephony APIs, this does not cause me any doubt whatsoever. Here's a fairly straightforward implementation:
String[] availableActions = ["raw SQL for read last payment date" , "raw SQL for read current balance", ...]
String sqlToExecute = availableActions[toNumber(dataFromCaller)];
return new SQLStatement(sqlToExecute, bindParams).execute(); #Hah I am imune to SQL injections because I used bind parameters; I am the awesome
I mean, clearly I've given you the ability to crash this method already, right? (You can cause ArrayIndexOutOfBoundsException, trivially.)
There's all sorts of fun available if six months later a different team updates the utility method that actually defines availableActions to, e.g., add in SQL which is only used by sysadmins, through the web interface.
- deleted 14y ago[deleted]
- wdewind 14y agoCan you explain this further? I'm sure I'm missing something obvious, but what exactly would dataFromCaller be (I'm assuming the result of a function that maps an analyzed audio sample [input] to a number), and how could I manipulate it to cause the ArrayIndexOutOfBoundsException?
- tlrobinson 14y ago"Press 1 for foo. Press 2 for bar" I press 3.
- brazzy 14y agoBy saying "six" when the system just listed options 1 through 5 to you - or, as patio11 hinted, that may actually allow you to execute SQL statements not inteded to be accessable to cutomers at all.
- wdewind 14y agoAh, I misunderstood because I read the misleading title, which implied that input was human voice, not touch tone. Totally makes sense, thanks.
- blaines 14y agoThanks for the explanation. I'm still skeptical that sql could be injected though. I'm not seeing how DTMF or speech would translate to the punctuation usually required for that type of attack. P.S. Coding with telephony APIs sounds horrible. I used to do phone system installs (Nortel, etc) - glad I don't anymore!
- patio11 14y agoI'm not seeing how DTMF or speech would translate to the punctuation usually required for that type of attack. You're letting the user specify an index for an array pointer. There may be direct memory access involved (C code shudder somebody get Thomas, that stuff scares me). This combination has been proven to get a lot of people to any input they want and a whole lot they don't.
- blaines 14y agoI get it now, thanks!