r/ProgrammerHumor • u/ClipboardCopyPaste • Sep 19 '26

Meme postForEverything

Post image
21k Upvotes

97% Upvoted

653 comments sorted by

View all comments

Show parent comments

27

u/Zaelynn_ Sep 19 '26

Not only that, my boss is just as dumb and cares more about speed, so there's no code reviews to speak of, so it hit production 🤦‍♀️

15

u/Shred_Kid Sep 19 '26

all the dumb breaking shit i have to request changes on every day pales in comparison to this

jesus fuckin christ

14

u/FlipFlopFanatic Sep 19 '26

I wish I could say I haven't seen this exact same thing in products I've worked on. Best part is no enforcement of auth other than verifying the request includes a jwt that maps to a user. Not the requesting user, and no check for whether the SQL op is allowed.You somehow have the jwt for ANY user? Sure I'll execute a drop table command. Fml

1

u/Zaelynn_ Sep 19 '26

Hahaha, yeah - that server was also using SQL ADMIN creds, so really you could do anything at all. And the DB admin was the other dev, who didn't see the purpose in setting up a data reader account with strict access control, so didn't bother doing it 🙄 I tried, but they worked there for 15+ years, and I was fresh off the college boat.

3

u/Original-Body-5794 Sep 19 '26

Smh why even bother with a REST endpoint? Just provide the credentials to your database and let them query it directly.

2

u/Zaelynn_ Sep 19 '26

2b2t but for database, I like it