Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://tech.lgbt/users/twann/statuses/109913761165013130">Twann :flag_black: :heart_nb: (twann@tech.lgbt)'s status on Sunday, 30-Apr-2023 21:52:07 JST</a><a href="https://tech.lgbt/@twann" title="twann@tech.lgbt"><img src="https://gnusocial.jp/avatar/79140-48-20230104233357.webp" width="48" height="48" alt="Twann :flag_black: :heart_nb:" style="position: absolute; left: 0; top: 0;">Twann :flag_black: :heart_nb:</a></section><article><p>Nice work concatenating SQL queries with variables, <a href="https://tech.lgbt/tags/Cloudflare" rel="tag">#Cloudflare</a>! 👏 :blobfoxangrylaugh: <br>Oh, btw, they're supposed to be a <a href="https://tech.lgbt/tags/cybersecurity" rel="tag">#cybersecurity</a> company so IT'S BAD.</p><p>Oh and guess what? They marked the comment related to this as spam. :blobcat_thisisfine: </p><p><a href="https://tech.lgbt/tags/decloudflare" rel="tag">#decloudflare</a> <a href="https://tech.lgbt/tags/infosec" rel="tag">#infosec</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/1421282#notice-2902908">In conversation</a><time datetime="2023-04-30T21:52:07+09:00" title="Sunday, 30-Apr-2023 21:52:07 JST">Sunday, 30-Apr-2023 21:52:07 JST</time> <span>from <span><a href="https://tech.lgbt/@twann/109913761165013130" rel="external" title="Sent from tech.lgbt via ActivityPub">tech.lgbt</a></span></span><a href="https://tech.lgbt/@twann/109913761165013130">permalink</a><h4>Attachments</h4><ol><li><label><a rel="external" href="https://gnusocial.jp/attachment/892862">Wildebeest source code showing the concatenation of an SQL query with variables.</a></label><br><a href="https://s3.us-east-005.backblazeb2.com/techlgbt/media_attachments/files/109/913/753/001/652/290/original/c377499b4358ab9f.png" rel="external">https://s3.us-east-005.backblazeb2.com/techlgbt/media_attachments/files/109/913/753/001/652/290/original/c377499b4358ab9f.png</a></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/892863">A GitHub comment by WesleyAC marked as spam  that reads:it's also real cool and good to assemble the sql statements with string interpolation. afaict that doesn't cause any sql injection problems in the current code, but as soon as there's a path that calls getObjectBy with a attacker-controlled key or something like that there's gonna be problems.definitely not a sign of half baked software rushed to ship or anything like that!</a></label><br><a href="https://s3.us-east-005.backblazeb2.com/techlgbt/media_attachments/files/109/913/753/089/520/415/original/edd0f602ebc930b7.png" rel="external">https://s3.us-east-005.backblazeb2.com/techlgbt/media_attachments/files/109/913/753/089/520/415/original/edd0f602ebc930b7.png</a></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Twann :flag_black: :heart_nb: (twann@tech.lgbt)'s status on Sunday, 30-Apr-2023 21:52:07 JST Twann :flag_black: :heart_nb:
Nice work concatenating SQL queries with variables, #Cloudflare! 👏 :blobfoxangrylaugh:
Oh, btw, they're supposed to be a #cybersecurity company so IT'S BAD.
Oh and guess what? They marked the comment related to this as spam. :blobcat_thisisfine:
#decloudflare #infosec
In conversationSunday, 30-Apr-2023 21:52:07 JST from tech.lgbtpermalink
Attachments
1. Wildebeest source code showing the concatenation of an SQL query with variables.
  https://s3.us-east-005.backblazeb2.com/techlgbt/media_attachments/files/109/913/753/001/652/290/original/c377499b4358ab9f.png
2. A GitHub comment by WesleyAC marked as spam that reads: it's also real cool and good to assemble the sql statements with string interpolation. afaict that doesn't cause any sql injection problems in the current code, but as soon as there's a path that calls getObjectBy with a attacker-controlled key or something like that there's gonna be problems. definitely not a sign of half baked software rushed to ship or anything like that!
  https://s3.us-east-005.backblazeb2.com/techlgbt/media_attachments/files/109/913/753/089/520/415/original/edd0f602ebc930b7.png

Public

Embed Notice

HTML Code

Corresponding Notice