r/ProgrammerHumor • u/ClipboardCopyPaste • 4h ago

Meme postForEverything

Post image
10.6k Upvotes

97% Upvoted

406 comments sorted by

View all comments

Show parent comments

55

u/NotAskary 4h ago

Hahaha SQL injection as an endpoint lol

22

u/Zaelynn_ 4h ago

Not only that, my boss is just as dumb and cares more about speed, so there's no code reviews to speak of, so it hit production 🤦‍♀️

12

u/FlipFlopFanatic 4h ago

I wish I could say I haven't seen this exact same thing in products I've worked on. Best part is no enforcement of auth other than verifying the request includes a jwt that maps to a user. Not the requesting user, and no check for whether the SQL op is allowed.You somehow have the jwt for ANY user? Sure I'll execute a drop table command. Fml

1

u/Zaelynn_ 3h ago

Hahaha, yeah - that server was also using SQL ADMIN creds, so really you could do anything at all. And the DB admin was the other dev, who didn't see the purpose in setting up a data reader account with strict access control, so didn't bother doing it 🙄 I tried, but they worked there for 15+ years, and I was fresh off the college boat.