Path: csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail
From: Chris Angelico <rosuav@gmail.com>
Newsgroups: comp.lang.python
Subject: Re: WP-A: A New URL Shortener
Date: Sat, 26 Mar 2016 14:46:38 +1100
Lines: 45
Message-ID: <mailman.18.1458964008.28225.python-list@python.org>
References: <1537bd9e261.12a0e5b4a204345.4468160629979098801@vmesel.com> <CAGq7KhregQabRkwUg6EQbqqy97FaYrC7WuWuSdO-=mhg0GSneg@mail.gmail.com> <500E8DF1-DCAC-4923-BD94-06DA1716484A@vmesel.com> <mailman.291.1458254120.12893.python-list@python.org> <1964524.jFVgOtWIx9@PointedEars.de> <mailman.298.1458257054.12893.python-list@python.org> <2334208.C0ktZ5B2k1@PointedEars.de> <mailman.392.1458396992.12893.python-list@python.org> <4500052.tJGngFWhWt@PointedEars.de> <mailman.13.1458942513.28225.python-list@python.org> <7663219.M9yg8PEDtW@PointedEars.de> <mailman.14.1458947054.28225.python-list@python.org> <2279730.a2M0GptDFN@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
In-Reply-To: <2279730.a2M0GptDFN@PointedEars.de>
Precedence: list
Xref: csiph.com comp.lang.python:105726

On Sat, Mar 26, 2016 at 2:30 PM, Thomas 'PointedEars' Lahn
<PointedEars@web.de> wrote:
> Since nothing indicates the used module and accessed DBMS (only that, if =
it
> is Python code, the module cannot be sqlite3 as that does not support =E2=
=80=9C%s=E2=80=9D),
> then this code can, if the module uses an escaping mechanism, still be
> vulnerable to SQL injection.  For example, I could input something to the
> effect of
>
> #------------------------------------------------------------------------=
---
> data =3D r'\"); DROP TABLE some_table; --'
> #------------------------------------------------------------------------=
---
>
> if, for example, the string escaping mechanism in the module would simply
> duplicate any double-quote it finds to escape it in the string literal th=
at
> it created (as is possible in MySQL and PostgreSQL), and still inject my
> code because the resulting query would be
>
>   insert into some_table (some_column) values ("\"");
>   DROP TABLE some_table;
>   --")
>
> which is at least syntactically valid MySQL code, but from the perspectiv=
e
> of the so-attacked it is still not fine as the table would be gone
> afterwards.

In other words, you are assuming that the string escaping *in the
module* is buggy. Well, duh. This is exactly what I said about not
having stupid bugs. The developer of a MySQL binding library should
know the *entire* rules for escaping, and, duh, that's going to
include escaping the backslash. So the escaped query would be
something like:

  insert into some_table (some_column) values ("\\"");
  DROP TABLE some_table;
  --")

which would be interpreted correctly by MySQL.

ChrisA