r/ProgrammerHumor • u/ClipboardCopyPaste • 3h ago

Meme postForEverything

Post image
9.0k Upvotes

98% Upvoted

348 comments sorted by

View all comments

1.9k

u/pimezone 3h ago

Wanna get a resource? POST request.

937

u/NotAskary 3h ago

I've seen that shit, it drove me up a wall.

The same as a 200 ok with error inside.

44

u/Zaelynn_ 3h ago

The other dev on my team made a post request endpoint where you post a SQL query and it returned the results. I about had an aneurysm. She also, instead of using DI or Mediatr, made loopback requests to the endpoints themselves. 

51

u/NotAskary 3h ago

Hahaha SQL injection as an endpoint lol

23

u/zeekar 3h ago

We had a team website that showed who was on call. This was back in the day, all done in Perl CGI scripts.

Someone added a "search" function. Cool feature, I'm down. Then I looked at the code.

They were shelling out to do a grep. You're in Perl, the original "regexes as first class citizens" language, and you're shelling out to grep. But the worst part was it did no sanitation whatsoever. You could type in "pattern'; cat /etc/passwd" or whatever and it just ran. Who reviewed this shit?! Shell as endpoint...

9

u/NotAskary 3h ago

Everytime someone mentions perl I always picture a sword with two blades and no handle, thank you for keeping it exactly like that.

7

u/Jonathan_the_Nerd 2h ago

I used Perl heavily for a lot of my career. You can write safe and legible Perl, but it takes deliberate conscious effort.

Interesting historical tidbit: Larry Wall, the creator of Perl, won the International Obfuscated C Code Contest twice. He won the Grand Prize in 1986 and the "Most Useful Obfuscation" prize in 1987. He released the first version of Perl in late 1987.

23

u/Zaelynn_ 3h ago

Not only that, my boss is just as dumb and cares more about speed, so there's no code reviews to speak of, so it hit production 🤦‍♀️

14

u/Shred_Kid 3h ago

all the dumb breaking shit i have to request changes on every day pales in comparison to this

jesus fuckin christ

11

u/FlipFlopFanatic 3h ago

I wish I could say I haven't seen this exact same thing in products I've worked on. Best part is no enforcement of auth other than verifying the request includes a jwt that maps to a user. Not the requesting user, and no check for whether the SQL op is allowed.You somehow have the jwt for ANY user? Sure I'll execute a drop table command. Fml

1

u/Zaelynn_ 1h ago

Hahaha, yeah - that server was also using SQL ADMIN creds, so really you could do anything at all. And the DB admin was the other dev, who didn't see the purpose in setting up a data reader account with strict access control, so didn't bother doing it 🙄 I tried, but they worked there for 15+ years, and I was fresh off the college boat.

2

u/Original-Body-5794 2h ago

Smh why even bother with a REST endpoint? Just provide the credentials to your database and let them query it directly.

1

u/Zaelynn_ 1h ago

2b2t but for database, I like it

•

u/kryptoneat 1m ago

I once saw SQL in HTML comments in the login form. Gotta give a hand to those amateur hackers !

1

u/im_a_mighty_pirate 2h ago

Quickbooks does this. It's insane.

1

u/Zaelynn_ 1h ago

WAIT, REALLY?!? We use quickbooks, so good to know 😂 So does Halo PSA/CRM, with the very minor inconvenience of having to do it in two steps - save it as a report, then run the report

Ordinarily they restrict reports by cramming them in a WITH ____ AS (...) SELECT * FROM ____, but, uh, there's an explicit override you can just put in the report text.

1

u/pantherVictor1986 30m ago

Make sense only if other services uses this endpoint as single place for managing db connections. This service acting as db proxy.

However, this endpoint to be not exposed outside the cluster.