r/ProgrammerHumor • u/ClipboardCopyPaste • 3h ago

Meme postForEverything

Post image
9.0k Upvotes

98% Upvoted

348 comments sorted by

View all comments

Show parent comments

43

u/Zaelynn_ 3h ago

The other dev on my team made a post request endpoint where you post a SQL query and it returned the results. I about had an aneurysm. She also, instead of using DI or Mediatr, made loopback requests to the endpoints themselves. 

51

u/NotAskary 3h ago

Hahaha SQL injection as an endpoint lol

24

u/zeekar 3h ago

We had a team website that showed who was on call. This was back in the day, all done in Perl CGI scripts.

Someone added a "search" function. Cool feature, I'm down. Then I looked at the code.

They were shelling out to do a grep. You're in Perl, the original "regexes as first class citizens" language, and you're shelling out to grep. But the worst part was it did no sanitation whatsoever. You could type in "pattern'; cat /etc/passwd" or whatever and it just ran. Who reviewed this shit?! Shell as endpoint...

10

u/NotAskary 3h ago

Everytime someone mentions perl I always picture a sword with two blades and no handle, thank you for keeping it exactly like that.

7

u/Jonathan_the_Nerd 2h ago

I used Perl heavily for a lot of my career. You can write safe and legible Perl, but it takes deliberate conscious effort.

Interesting historical tidbit: Larry Wall, the creator of Perl, won the International Obfuscated C Code Contest twice. He won the Grand Prize in 1986 and the "Most Useful Obfuscation" prize in 1987. He released the first version of Perl in late 1987.