5 ms·
"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit
by simonw 6mo ago
"The values passed to _sort were concatenated directly into SQL ORDER BY clauses with no validation" - sounds to me like this project had some low-hanging fruit!
Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record.
This is actually a pretty good example of the value of AI security scanners - even really strong development teams still occasionally let bugs like this slip through, having an AI scanner that can spot them feels worthwhile to me.
- hilariously 6mo agoHonestly those all sound like common linters could find things like string concatenation.
- Taters91 6mo agoThese kind of checks were available without AI.
- deleted 6mo ago[deleted]
- sheikhnbake 6mo agoMath is doable without a calculator
- happytoexplain 6mo agoThe headline is "AI uncovers...", implying that the standard static analyzers used by basically everybody didn't catch them.
- serf 6mo agoisn't this just sort of turning chicken-or-egg? if an AI uses static analyzers to do work ,is it the tool or the ai ? if AI is using grep to do the work, is it the AI or grep? I mean essentially all agent work boils down to "cat or grep?"
- positron26 6mo agoWas the human labor?
- RA_Fisher 6mo agoAI gives us a means of leverage. We can do more with less. production = f(labor, capital, technology) + eps
- krainboltgreene 6mo agoThis always comes up and the only thing I can think is: Doesn't Google make like 10B a quarter in profit from GCP alone? Did we really need a cheaper SQL injection checker?
- gowld 6mo agoI think SQL Injection detectors were pretty mature even before the "AI" version?
- EGreg 6mo ago“even really strong development teams” One would think a single really strong developer, let alone a team, would look for interpolation in strings fed to RDBMS?
- tmoertel 6mo ago> Looks like every single one of the 38 vulnerabilities were either SQL injection, XSS, path traversal or "Insecure Direct Object Reference" aka failing to check the caller was allowed to access the record. Seems like code review against a checklist of the most common vulnerabilities would have prevented these problems. So I guess there are two takeaways here: First, AI scanners are useful for catching security problems your team has overlooked. Second, maintaining a checklist of the most-common vulnerabilities and using it during code review is likely to not only prevent most of the problems that AI is likely to catch, but also show your development team many of their security blind spots at review time and teach them how to light those areas. That is, the team learns how to avoid creating those security mistakes in the first place.
- dgb23 6mo agoBut by not having a checklist you avoid that your blind spots get exposed.
- tmoertel 6mo agoWhy would you want to prevent your development team from learning about their blind spots?
- capiki 6mo agoWhat about having the checklist and having an AI tool use it to catch things at review time (or even development time)?
- gchamonlive 6mo agoIsn't this something SonarQube catches?
- webXL 6mo agoYes. Isn't this something code review catches? :)
- positron26 6mo agoPresuming there is an infinite pool of programmers who tirelessly work for a low price?
- deleted 6mo ago[deleted]
- gchamonlive 6mo agoI'm really curious what's your line of thinking here. Could you elaborate?
- happytoexplain 6mo agoSometimes, but not nearly as reliably as a static analyzer. But I'm assuming the unstated point you are sarcastically implying is "you don't need SonarQube" - maybe you're trying to say something else.
- gchamonlive 6mo agoWebXL makes no sense, because that's comparing oranges to apples.
- camdenreslink 6mo agoI don't think strong development teams are still letting SQL injection vulnerabilities through by manually concatenating strings to build queries with user-provided data. Not in the year 2026.
- simonw 6mo agoGood frameworks can protect against SQL injection and XSS (through default escaping of output variables) but protecting against insecure direct object access is a lot harder.
- voxic11 6mo agoKeep in mind this project is a 25 year old PHP application.
- zarzavat 6mo agoThat actually makes it more confusing since a 25 year old PHP application is exactly where you'd expect to find SQL injection vulnerabilities. If I were in charge of a 25 year old PHP application, tracking down every SQL query and converting it to a safe form would high on my list of priorities. You don't need AI for that, just ripgrep and a basic amount of care for your users.
- otabdeveloper4 6mo agoReplacing/automating manual ripgrep is a top-1 use case for AI though.
- pseudalopex 6mo agoTheir point was a competent team would have done this since 10 or 20 years I thought.
- whythismatters 6mo agoMost (proprietary) 25 year old PHP codebases I've seen are a huge mess riddled with issues, exuberant loc, mix of tabs and spaces and weird indentation, dry violations, slightly diverging code blocks copy-pasted all over the place, etc., etc. Resolving technical debt (let alone reviewing the "stuff that works" like SQL queries) is often low priority because it's tedious and does not create any "business value".
- gostsamo 6mo ago> This is actually a pretty good example of the value of AI security scanners Are you fuckin' serious? This would be caught with any self-respecting scanner even 5 years ago and with most educated juniors even earlier. I use AI every day, but I'm not deep enough in the dilulu to believe that everything above two brain cells should be a transformer.
- simonw 6mo agoWhich scanners catch insecure direct object access?
- nudpiedo 6mo agoThere are Static code analyzers which already would have detected that. And these were also automatic. Looks very likely that the team didn’t give a damn about top basic security and good practices. Like a house made of paper wouldn’t be an example of the insecurity of the construction industry.
- simonw 6mo agoWhich static code analyzers do you recommend?
- happytoexplain 6mo agoSonarQube is extremely common, but I'm sure there are many.
- Groxx 6mo ago>even really strong development teams still occasionally let bugs like this slip through agreed, though I think you'd be hard-pressed to find anyone who uses healthcare-related software professionally who thinks any "really strong development team" was involved in its creation.