Kenny2999 231 points 5 months ago

path: 0 23918949, hotness: undefined, score: 231, children: 25

akunohana 20 points 5 months ago

How would you do this in C? I'm a beginner. Does it entail checking/disallowing certain characters and data types? What? 😃

save

path: 0 23918949 23920311, hotness: undefined, score: 20, children: 12

vrek 34 points 5 months ago

How do you sanitize your inputs or how do you exploit inputs which are not sanitized.

save

path: 0 23918949 23920311 23920524, hotness: undefined, score: 34, children: 6

akunohana 29 points 5 months ago

Santize inputs.

I'll get back to you on exploits when I can write something that throws zero compilation errors. 😈

save

path: 0 23918949 23920311 23920524 23920569, hotness: undefined, score: 29, children: 5

vrek 29 points 5 months ago

Couple big things are 1. Only accept reasonable characters, on a white list instead of rejecting bad characters based on a black list. This will mean you are less likely to forget to block /0 for example. 2. Understand how strings work and ensure both reading and writing to that string doesn't extend beyond the end of memory allocated for the string. For example do you understand what the /0 would do to a string your program accepts?

save

path: 0 23918949 23920311 23920524 23920569 23921118, hotness: undefined, score: 29, children: 4

copacetic 20 points 5 months ago

If you use the SQLite C API like this

    char query[256];
    snprintf(query, sizeof(query),
             "SELECT * FROM users WHERE username = '%s'", username);
    int rc = sqlite3_exec(db, query, NULL, NULL, &err_msg);

and someone enters Robert'; DROP Table Students;-- as username, it deletes the table Students.

    const char *sql = "SELECT * FROM users WHERE username = ?";
    int rc = sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
    if (rc != SQLITE_OK) {
        fprintf(stderr, "Failed to prepare statement\n");
        return;
    }
    sqlite3_bind_text(stmt, 1, username, -1, SQLITE_STATIC);

Using this "prepared statement" and "bind", your code is secured against such SQL injection attacks.

save

path: 0 23918949 23920311 23925203, hotness: undefined, score: 20, children: 0

jaybone 16 points 5 months ago

Many languages like C, Java, Python, etc allow you to construct SQL queries or SQL statements, where SQL is its own language used to communicate with a database, like Oracle or MySql, or Postgres or MSSQL. One way to do this is to construct a string in your language using whatever string functions, concatenation etc available in your language. The problem occurs because usually you want some kind of user input as one of the parameters in your sql query, in order to fetch the correct records the user is asking for. Like say a record ID or name. If you do not properly sanitize that ID or name which originally comes from some type of user input, then a malicious user could carefully craft an ID or name which includes their own SQL and other special characters, which will interfere with the query you intended to construct, and instead do something malicious. Like delete records or obtain records the user is not supposed to have access to.

There are many ways to guard against this, and you should learn about this when you start working with SQL and databases. It’s called a SQL injection.

There is another type of code injection which can occur if you are making exec() calls (or whatever your language uses) to run shell commands. Similar caution should be taken there.

save

path: 0 23918949 23920311 23922146, hotness: undefined, score: 16, children: 2

thesystemisdown 6 points 5 months ago

I know what I'm dealing with when I see a query that isn't using a prepared statement.

save

path: 0 23918949 23920311 23922146 23923106, hotness: undefined, score: 6, children: 1

jaybone 3 points 5 months ago

I mean a prepared statement is still created with a string.

But you definitely want to be using bind parameters with your prepared statements. Not only for security but also potentially performance improvements.

save

path: 0 23918949 23920311 23922146 23923106 23923228, hotness: undefined, score: 3, children: 0

LovableSidekick 6 points 5 months ago

You wouldn't - what they're describing is called "SQL injection" - a way to fool poorly written web server code (regardless of what language it's writen in) into executing SQL code. The poorly written server code takes what's entered in a form field on a web page and pastes it into a skeleton of a SQL statement - in this case the text in the input field is SQL that ends the intended statement, followed by a new statement that deletes a table. For this to even work, the SQL skeleton on the server would have to be structured in just the right way so the modified version with the pasted-in text still makes sense. For this reason, hackers attempting SQL injection usually have to do a lot of trial and error to get something to happen. The only way it can work at all is if the server software handling the web page sends SQL commands to a database server as text, as if they're being typed in, and the server executes them. You can't inject C in this way because unlike SQL, C code isn't just executed, C programs have to be precompiled.

save

path: 0 23918949 23920311 23924065, hotness: undefined, score: 6, children: 0

RobertTableaux 12 points 5 months ago

My day has come!!!

save

path: 0 23918949 23928892, hotness: undefined, score: 12, children: 0

deadbeef79000 8 points 5 months ago

Don't sanitise inputs. Reject non-conforming inputs entirely.

But otherwise: yes.

save

path: 0 23918949 23928497, hotness: undefined, score: 8, children: 10

Valmond 9 points 5 months ago

And end up having loads of valid requests rejected 😁

save

path: 0 23918949 23928497 23929812, hotness: undefined, score: 9, children: 6

deadbeef79000 3 points 5 months ago

If they were valid they wouldn't be rejected.

save

path: 0 23918949 23928497 23929812 23929838, hotness: undefined, score: 3, children: 5

AzuraTheSpellkissed 5 points 5 months ago

I've managed webapps which rejected "René". Heck, my deadname has a hyphen, which often is considered illegal

save

path: 0 23918949 23928497 23929812 23929838 23939375, hotness: undefined, score: 5, children: 1

Valmond 4 points 5 months ago

Well then someone with a Tagalog name gets caught in your filter...

I mean if it's "perfect" they yes, it'll work, but in production...

Also, you sometimes want to be able to store "1); Drop table abc;" in your database, I mean how do you otherwise store this comment right here? Sanitizing.

save

path: 0 23918949 23928497 23929812 23929838 23930058, hotness: undefined, score: 4, children: 2

nonagonOrc 8 points 5 months ago

No fuck both of those, just use prepared statements so user input can't be interpreted as SQL.

save

path: 0 23918949 23928497 23933146, hotness: undefined, score: 8, children: 0

ivanafterall 5 points 5 months ago

I'll never conform!

save

path: 0 23918949 23928497 23929176, hotness: undefined, score: 5, children: 1

deadbeef79000 3 points 5 months ago

Righteous.

save

path: 0 23918949 23928497 23929176 23929567, hotness: undefined, score: 3, children: 0

Klear 122 points 5 months ago

I see little Bobby Tables is all grown up

save

path: 0 23918912, hotness: undefined, score: 122, children: 1

Valmond 4 points 5 months ago

He's taking painting classes. Let's see if the database there can handle him!

save

path: 0 23918912 23929821, hotness: undefined, score: 4, children: 0

zqwzzle 109 points 5 months ago

[object Object]

save

path: 0 23918895, hotness: undefined, score: 109, children: 3

panda_abyss 36 points 5 months ago

Yes?

save

path: 0 23918895 23919616, hotness: undefined, score: 36, children: 0

resipsaloquitur 12 points 5 months ago

What? My mother was a saint!

save

path: 0 23918895 23921834, hotness: undefined, score: 12, children: 0

inari 4 points 5 months ago

NaN

save

path: 0 23918895 23928180, hotness: undefined, score: 4, children: 0

elvith 84 points 5 months ago

I � Unicode!

save

path: 0 23921093, hotness: undefined, score: 84, children: 1

FreshLight 25 points 5 months ago

I like this very much! It implies that the person expressing this knows exactly how they feel about Unicode. It's just us, the readers (or some other link in the chain), who have/ has the wrong encoding.

save

path: 0 23921093 23922368, hotness: undefined, score: 25, children: 0

ValiantDust 69 points 5 months ago

Unless they work for Microsoft. Teams has been showing � instead of ä for the caller's name in the popup when someone calls for several weeks now. It didn't use to do that before. I don't think they care anymore.

save

path: 0 23921507, hotness: undefined, score: 69, children: 1

ChickenLadyLovesLife 22 points 5 months ago

I don't think it's even "they" any more.

save

path: 0 23921507 23924193, hotness: undefined, score: 22, children: 0

_stranger_ 66 points 5 months ago

Allow me to introduce you to my favorite Unicode character, the zero width space

https://unicode-explorer.com/c/200B

save

path: 0 23922449, hotness: undefined, score: 66, children: 14

blah3166 40 points 5 months ago

that sounds awesome! (there's 10k zero width spaces between the quotes ->''.)

save

path: 0 23922449 23923848, hotness: undefined, score: 40, children: 9

DisasterTransport 23 points 5 months ago

save

path: 0 23922449 23923848 23928374, hotness: undefined, score: 23, children: 3

ivanafterall 9 points 5 months ago

I'll be damned. The crazy son of a bitch did it!

save

path: 0 23922449 23923848 23928374 23929162, hotness: undefined, score: 9, children: 0

noughtnaut 4 points 5 months ago

Hey that's a neat tool. Link?

save

path: 0 23922449 23923848 23928374 23930060, hotness: undefined, score: 4, children: 1

DisasterTransport 7 points 5 months ago

save

path: 0 23922449 23923848 23928374 23930060 23930241, hotness: undefined, score: 7, children: 0

flint 18 points 5 months ago

Checks out:

save

path: 0 23922449 23923848 23925717, hotness: undefined, score: 18, children: 0

_stranger_ 8 points 5 months ago

save

path: 0 23922449 23923848 23926302, hotness: undefined, score: 8, children: 0

solxix 7 points 5 months ago

On Interstellar it shows up as normal spaces for me so there's just a giant block of empty space

save

path: 0 23922449 23923848 23927276, hotness: undefined, score: 7, children: 1

blah3166 1 point 5 months ago

sorry about that

save

path: 0 23922449 23923848 23927276 23944509, hotness: undefined, score: 1, children: 0

Whelks_chance 6 points 5 months ago

Odd, on the Connect app it shows a bunch of spaces, but not 10k of them.

save

path: 0 23922449 23923848 23930464, hotness: undefined, score: 6, children: 0

Opisek 16 points 5 months ago

Unfortunately, evil people blacklist this character a lot :(

May I introduce you to my favorite Unicode character, the Braille zero dots

https://unicode-explorer.com/c/2800

save

path: 0 23922449 23931277, hotness: undefined, score: 16, children: 1

captcha_incorrect 4 points 5 months ago

Here is the big list of naughty strings.

save

path: 0 23922449 23931277 23946215, hotness: undefined, score: 4, children: 0

lalala 7 points 5 months ago

What kind of devil came up with this?

save

path: 0 23922449 23928745, hotness: undefined, score: 7, children: 1

Strawberry 5 points 5 months ago

The justification is on the linked page

save

path: 0 23922449 23928745 23928849, hotness: undefined, score: 5, children: 0

Enkrod 32 points 5 months ago

Allow me to make one thing perfectly clear: If you insert those symbols into my perfectly working website... only to mess with me and inadvertently give me vietnam-style flashbacks to the days when I had to deal with incredibly badly formed and misencoded CSV-files on the daily...

Then I will find you and break into your home to replace every second sock with one of the same color and pattern but slightly different make, size or material and you will always wonder why you can't find any exactly fitting pairs of socks anymore.

save

path: 0 23932805, hotness: undefined, score: 32, children: 5

ivanafterall 24 points 5 months ago

I willingly embraced mismatched socks years ago. I just pretend it's a fashion statement. Come at me bro.

save

path: 0 23932805 23932836, hotness: undefined, score: 24, children: 4

captcha_incorrect 4 points 5 months ago

I always buy identical socks, cannot mismatch if they are all the same.

save

path: 0 23932805 23932836 23946154, hotness: undefined, score: 4, children: 0

NotMyOldRedditName 4 points 5 months ago

I started buying all the same sock type, but some might have a little gray or a little brown in the variation, and I dont care, I mix/match.

If one gets a hole its just one of many and is tossed.

save

path: 0 23932805 23932836 23938576, hotness: undefined, score: 4, children: 1

ivanafterall 3 points 5 months ago

I buy colorful, patterned socks of all kinds. Mostly they stay together, but if not, it's fun to pick new partners.

save

path: 0 23932805 23932836 23938576 23940555, hotness: undefined, score: 3, children: 0

vanillama 2 points 5 months ago

Don't let the world change you, this is wonderful

save

path: 0 23932805 23932836 24001513, hotness: undefined, score: 2, children: 0

Rhaedas 26 points 5 months ago

Depends on if it breaks the form and they get called. Actually if it gets through they might rightfully question their sanitation coding.

save

path: 0 23918896, hotness: undefined, score: 26, children: 0

ODuffer 25 points 5 months ago

▞☒ę

save

path: 0 23919126, hotness: undefined, score: 25, children: 2

NoSpotOfGround 15 points 5 months ago

Not always, but most times, yeah.

save

path: 0 23919126 23919327, hotness: undefined, score: 15, children: 0

gruvn 7 points 5 months ago

Pretty sure that's illegal here.

save

path: 0 23919126 23920444, hotness: undefined, score: 7, children: 0

Quexotic 19 points 5 months ago

To the op of the screenshot meme, calm down satan

save

path: 0 23928208, hotness: undefined, score: 19, children: 0

Valmond 18 points 5 months ago

Calm down satan 😅

save

path: 0 23918851, hotness: undefined, score: 18, children: 0

LovableSidekick 18 points 5 months ago

Former dev here, can confirm on occasion it does.

save

path: 0 23923876, hotness: undefined, score: 18, children: 0

9point6 17 points 5 months ago

Actual monster

save

path: 0 23918999, hotness: undefined, score: 17, children: 0

Kojichan 13 points 5 months ago

Usually only happened when a French person copied and pasted their text directly from a Word document... dang weird spaces and accented characters... drove my boss mad when I told him it was because it French, and not a glitch.

Still had to work around it... text counters in textboxes had to account for accented characters, which took two bytes instead of one.

"I only have 2000 letters!" ... 2000 including 200 accent characters made it 2200 characters, not 2000.

save

path: 0 23926834, hotness: undefined, score: 13, children: 8

AnUnusualRelic 5 points 5 months ago

“I only have 2000 letters!” … 2000 including 200 accent characters made it 2200 characters, not 2000.

Or, you could count it in Unicode characters, and not in whatever bizarro charset you're using over there. Then "À" is one character, just as it's supposed to be.

The problem typically comes from improper conversion between charsets. Like Windows-1252 to Unicode, or something equally horrible.

save

path: 0 23926834 23932471, hotness: undefined, score: 5, children: 3

Kojichan 1 point 5 months ago

I was basically calculating in Javavscript then in PHP for validation before I sent it to Zoho.

The DB also was fine. It was honestly just PHP and Javascript. It's all good now though!

save

path: 0 23926834 23932471 23938502, hotness: undefined, score: 1, children: 0

calcopiritus 1 point 5 months ago

Not if the maximum is due to the database being configured to have a maximum space of 2000 bytes for that field.

save

path: 0 23926834 23932471 23933104, hotness: undefined, score: 1, children: 1

AnUnusualRelic 2 points 5 months ago

Ah, well, bytes ≠ characters, but yes, that can certainly be an issue.

save

path: 0 23926834 23932471 23933104 23933816, hotness: undefined, score: 2, children: 0

calcopiritus 1 point 5 months ago

Easy. Just use utf-32 and make the text field a maximum of 500 letters. That will be a maximum of 2000 bytes, doesn't matter if the user is french or Chinese.

save

path: 0 23926834 23933082, hotness: undefined, score: 1, children: 1

Kojichan 1 point 5 months ago

XD ahahah.

save

path: 0 23926834 23933082 23938521, hotness: undefined, score: 1, children: 0

Hudell 1 point 5 months ago

I remember one day long ago when Notepad++ was the real shit, I was using the vertical selection feature and noticed that the selection was shorter on lines that had accented characters. I thought: "huh, accented characters count as two? What would happen if the selection ended in one? Can I select half a character?" no I could not and I had to restart my computer after trying.

save

path: 0 23926834 23947025, hotness: undefined, score: 1, children: 1

Kojichan 1 point 5 months ago

I loved Notepad++.

Started in DOS with Edit, regular notepad, got introduced to UltraEdit, then found NP++.

... lol. Sounds like you tried splitting an atom.

save

path: 0 23926834 23947025 23953846, hotness: undefined, score: 1, children: 0

mlg 13 points 5 months ago

I remember feeling extra powerful when Moonshell for the DS shipped with UTF-8 and UTF-16 support because the developer was japenese and wanted to make sure any language would work.

save

path: 0 23924911, hotness: undefined, score: 13, children: 0

Pika 12 points 5 months ago

Ok calm down there Satan. Leave some chaos for the rest of us 😅

save

path: 0 23921657, hotness: undefined, score: 12, children: 0

GreenKnight23 11 points 5 months ago

my favorite thing to do is go to small town websites and look at the page source for their forms. 70% of the time they have inputs commented out to "disable" forms or just deprecated functionality.

I like to uncomment them and submit the forms just to fuck with them 🤣

save

path: 0 23941037, hotness: undefined, score: 11, children: 1

python 5 points 5 months ago

I was applying to a job recently, and their online form had a "Upload your documents here" field. Problem was, the input was set to only accept a single file. Well, I wanted to upload two, so I just went into the html and added "multiple" to the input. Which just worked, I even checked the network tab to confirm that both files were submitted.
Haven't heard back from that company yet. It was a web dev position so I hope they appreciate my hijinks 🤞

save

path: 0 23941037 23948420, hotness: undefined, score: 5, children: 0

cupcakezealot 11 points 5 months ago

use %20 randomly for fun

save

path: 0 23944720, hotness: undefined, score: 11, children: 1

umbraroze 5 points 5 months ago

Or just use MIME (e.g. =20). Guaranteed to make someone say "okay, how the hell did that happen?"

(It's also trendy because badly cleaned up MIME garbage is in the Epstein files!)

save

path: 0 23944720 23946862, hotness: undefined, score: 5, children: 0

Jakylla 10 points 5 months ago

□□□□□□□□ !!

save

path: 0 23924801, hotness: undefined, score: 10, children: 0

oopsgodisdeadmybad 9 points 5 months ago

Can this really not be fixed?

I still see this in various text that's meant to be readable.

Usually ampersands are the biggest culprit, but is it just a really sacred data type that can't be upgraded to include punctuation, but can include the foreign looking wingdings that try to stand in for it?

I'm just confused on why those characters have multi character reference names that aren't part of the regular alphabet or punctuation set either, but those still show up instead of having room to just remove the erroneous reference with the actual character.

It's 2026, just dig out this fossil and fix it already.

save

path: 0 23919280, hotness: undefined, score: 9, children: 4

funkless_eck 35 points 5 months ago

the wrong UTF encoding is usually the issue

save

path: 0 23919280 23919540, hotness: undefined, score: 35, children: 0

dohpaz42 9 points 5 months ago

It's 2026, just dig out this fossil and fix it already.

That’s the joke. 😅

save

path: 0 23919280 23919885, hotness: undefined, score: 9, children: 0

Hudell 1 point 5 months ago

The characters are all in your own pc. The text data is actually just numbers, referencing the index of each character in a reference table.

Early on someone thought "let's create a bunch of different reference tables and each country uses the one that is best for them so we don't have to include every character in the world".

But that thinking has a critical problem: when you write some text that will only be read within the country, you don't need to keep track of which table you used because everyone will be using the same. Soon you forget that there are other tables for other countries so when you do send an international text using your table as a reference, the person on the other side will be parsing it using their own table and the resulting text will be different. And sometimes when this mixup happens, the index referenced by the text in the other table may actually be some internal control character that is not meant for rendering.

These days the problem is "mostly fixed" by the near-universal adoption of a single reference table that proposes including verything you may ever need (even a lot of emojis) - but this large table means that each character in a text may need more digits to represent the intended index so the total file size for the same text is larger than it would be with the non-universal table.

save

path: 0 23919280 23947257, hotness: undefined, score: 1, children: 1

oopsgodisdeadmybad 1 point 5 months ago

Exactly. My point is to move to a single universal standard that is used by literally everything so this never happens. Just cut off everything that can't be updated, and it can just sink or swim based on how well it can parse the new table.

Fuck all that ancient non-updateable shit. There's no good reason that old table still exists, much less be possible to use this side of 2000.

Obviously this has legacy problems, but fuck those systems, everyone gotta get new shit now, tough shit. The old table should be cause for new shit to fail compiling in the first place. Shouldn't be possible to use it.

Let's just make forward progress, and lose the chains.

save

path: 0 23919280 23947257 23958041, hotness: undefined, score: 1, children: 0

davidagain 8 points 5 months ago

You monster!

save

path: 0 23920469, hotness: undefined, score: 8, children: 0

diabetic_porcupine 7 points 5 months ago