I agree that it mentions indirection, but I don't agree that it is the purpose of the article at all. The article finishes with this line: > We are contacting

I agree that it mentions indirection, but I don't agree that it is the purpose of the article at all. The article finishes with this line: > We are contacting Google about it, but it is always something important to keep in the back of your mind. You can’t just whitelist their IP, and allow through without any type of inspection. I wouldn't be surprised if the authors knew of the sqli vector, and whitelists appropriate clients. The problem is the sqli, not WHO can hit it (or who was ultimately responsible). Edit: I just went and looked at the company behind this article. I was too quick to judge apparently. Their business is protecting developers from stupid mistakes like sqli at the firewall. Therefore, the article really IS about indirection. Sorry.