Discussion
Loading...

Post

Log in
  • About
  • Code of conduct
  • Privacy
  • Users
  • Instances
  • About Bonfire
Florian 'floe' Echtler
Florian 'floe' Echtler
@floe@hci.social  ·  activity timestamp 3 weeks ago

My 2nd-year students sent me a code snippet to review... I'm not super familiar with the express.js framework they've been using, but I do think little Bobby Tables might like to have a word 😈

#infosec #sql

export const addUser = (connection)=>{
  router.post('/api/data/add/user', (req, res)=>{
    const data = req.body;
    connection.query(
      'INSERT INTO usertable (FirstName, LastName, Username, AccessCode, UserEmail) VALUES (?,?,?,?,?)',
      [data.FirstName, data.LastName, data.Username, data.AccessCode, data.UserEmail],
      (err, results)=>{
         if(err){
            console.error(err);
            res.status(500).json({error: 'Database insertion (User) failed'});,→
         return; }
     res.json({ success: true, id: results.insertId});
    })
  })
  return router;
}
export const addUser = (connection)=>{ router.post('/api/data/add/user', (req, res)=>{ const data = req.body; connection.query( 'INSERT INTO usertable (FirstName, LastName, Username, AccessCode, UserEmail) VALUES (?,?,?,?,?)', [data.FirstName, data.LastName, data.Username, data.AccessCode, data.UserEmail], (err, results)=>{ if(err){ console.error(err); res.status(500).json({error: 'Database insertion (User) failed'});,→ return; } res.json({ success: true, id: results.insertId}); }) }) return router; }
export const addUser = (connection)=>{ router.post('/api/data/add/user', (req, res)=>{ const data = req.body; connection.query( 'INSERT INTO usertable (FirstName, LastName, Username, AccessCode, UserEmail) VALUES (?,?,?,?,?)', [data.FirstName, data.LastName, data.Username, data.AccessCode, data.UserEmail], (err, results)=>{ if(err){ console.error(err); res.status(500).json({error: 'Database insertion (User) failed'});,→ return; } res.json({ success: true, id: results.insertId}); }) }) return router; }
  • Copy link
  • Flag this post
  • Block
Max
Max
@maxxx@social.tchncs.de replied  ·  activity timestamp 3 weeks ago

@floe actually this one could be safe. They use the ? operator and a list, so depending on the implementation this probably passes the values as parameters, which is fine.

  • Copy link
  • Flag this comment
  • Block
Jan D
Jan D
@simulo@hci.social replied  ·  activity timestamp 3 weeks ago

@floe Will SQL evaluate values (and thus potentially run injected code)?

  • Copy link
  • Flag this comment
  • Block
Florian 'floe' Echtler
Florian 'floe' Echtler
@floe@hci.social replied  ·  activity timestamp 3 weeks ago

@simulo not by default, but you can just put something like "); DROP DATABASE xxx;" into data.UserEmail.

  • Copy link
  • Flag this comment
  • Block

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About · Code of conduct · Privacy · Users · Instances
Bonfire social · 1.0.1-alpha.44 no JS en
Automatic federation enabled
Log in
  • Explore
  • About
  • Members
  • Code of Conduct