• tryptaminev 🇵🇸 🇺🇦 🇪🇺@feddit.de
      link
      fedilink
      arrow-up
      31
      arrow-down
      1
      ·
      edit-2
      10 months ago

      Are they vulnerable though, if they already exclude it at the user input?

      I yet have to learn SQL and is there a way to allow passwords with '); DROP TABLE… without being vulnerable to an injection?

      nevermind i googled it, and there various ways to do so

      • herrvogel@lemmy.world
        link
        fedilink
        arrow-up
        52
        arrow-down
        1
        ·
        10 months ago

        This still smells though. Why is the raw, plain text password string getting anywhere near database queries in the first place?

      • rtxn@lemmy.world
        link
        fedilink
        English
        arrow-up
        33
        ·
        edit-2
        10 months ago

        Prepared statements, mostly. You define the query using variables, turn that query into a language-dependent object, assign values to those variables, then execute the statement. The values will be passed verbatim, without any parsing.

        Or, since we’re talking about a password, you could encode or encrypt it before inserting it into the query string. The fact that the website could be negatively affected by phrases in the cleartext password is very concerning.

      • Ugly Bob@sh.itjust.works
        link
        fedilink
        arrow-up
        24
        ·
        10 months ago

        I noticed that upper case select, drop etc are not prohibited.

        Poorly implemented user input filters are not a valid solution to being vulnerable to injection.

      • emergencyfood@sh.itjust.works
        link
        fedilink
        arrow-up
        10
        ·
        10 months ago

        No one in their right mind is storing plain text passwords, or letting them anywhere near the database.

        You convert the password to a hash, and store that. And the hash will look nothing like the password the user typed.

        • acetanilide@lemmy.world
          link
          fedilink
          arrow-up
          12
          ·
          10 months ago

          You’re right. No one in their right mind would do that.

          On the other hand, people not in their right mind often run things. Such as my old professional liability insurance. Which wrote the username and password in the yearly statements…

          And also sent you the password through email if you forgot it…

          Also you couldn’t change it…

          • BURN@lemmy.world
            link
            fedilink
            arrow-up
            7
            ·
            10 months ago

            There was a popular companion app to a game I play that’s stored passwords as MD5 hashes for years and when they got hacked they were able to decrypt everything.

            Bonus point, the app was released multiple years after md5 was cracked.

            Developers (including myself) cannot be trusted to implement the correct process 100% of the time. It’s happened too many times for it to be a single person issue and has transcended into a problem with software engineers

        • usefulthings@lemmy.world
          link
          fedilink
          arrow-up
          3
          ·
          10 months ago

          Lol. Yes, people do still build systems and store plain text passwords. I regularly get scammers sending me my throwaway passwords from crappy sites. Good thing I never reuse passwords, or email addresses.

    • pirrrrrrrr@lemmy.dbzer0.com
      link
      fedilink
      arrow-up
      9
      arrow-down
      1
      ·
      10 months ago

      Maybe they filtered those strings to be safe, and put the notice there to answer the invertible “why won’t it accept my password” queries.

      It’s a shitty password engine. But not necessarily uncleansed

      • ArbitraryValue@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        6
        ·
        edit-2
        9 months ago

        If they’re trying to protect themselves from code injection by rejecting certain user input like that, then they don’t actually know how to protect themselves from code injection correctly and there may be serious vulnerabilities that they’ve missed.

        (I think it’s likely that, as others have said, they’re using off-the-shelf software that does properly sanitize user input, and that this is just the unnecessary result of management making ridiculous demands. Even then, it’s evidence of an organization that doesn’t have the right approach to security.)

    • thenextguy@lemmy.world
      link
      fedilink
      arrow-up
      5
      ·
      10 months ago

      This is the result of some doc writer or middle manager not fully understanding what they’ve been told.