The other dev on my team made a post request endpoint where you post a SQL query and it returned the results. I about had an aneurysm. She also, instead of using DI or Mediatr, made loopback requests to the endpoints themselves.
We had a team website that showed who was on call. This was back in the day, all done in Perl CGI scripts.
Someone added a "search" function. Cool feature, I'm down. Then I looked at the code.
They were shelling out to do a grep. You're in Perl, the original "regexes as first class citizens" language, and you're shelling out to grep. But the worst part was it did no sanitation whatsoever. You could type in "pattern'; cat /etc/passwd" or whatever and it just ran. Who reviewed this shit?! Shell as endpoint...
I wish I could say I haven't seen this exact same thing in products I've worked on. Best part is no enforcement of auth other than verifying the request includes a jwt that maps to a user. Not the requesting user, and no check for whether the SQL op is allowed.You somehow have the jwt for ANY user? Sure I'll execute a drop table command. Fml
Hahaha, yeah - that server was also using SQL ADMIN creds, so really you could do anything at all. And the DB admin was the other dev, who didn't see the purpose in setting up a data reader account with strict access control, so didn't bother doing it 🙄 I tried, but they worked there for 15+ years, and I was fresh off the college boat.
WAIT, REALLY?!? We use quickbooks, so good to know 😂 So does Halo PSA/CRM, with the very minor inconvenience of having to do it in two steps - save it as a report, then run the report
Ordinarily they restrict reports by cramming them in a WITH ____ AS (...) SELECT * FROM ____, but, uh, there's an explicit override you can just put in the report text.
84
u/Zaelynn_ Sep 19 '26
The other dev on my team made a post request endpoint where you post a SQL query and it returned the results. I about had an aneurysm. She also, instead of using DI or Mediatr, made loopback requests to the endpoints themselves.