Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch > #5007

Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy

Cross-posted to 5 groups.

Show all headers | View raw

Andy "Krazy" Glew wrote:
> Listening to an old "Security Now" podcast while doing my morning
> stretches.
>
> Leo Laporte's TWIT website was hacked, and Steve Gibson, the Security
> Guy, says "Any time you are soliciting user input, there is a risk of
> malicious input somehow tricking the backend and executing that input,
> when it is meant to be, you know, benign [input data, like] user name
> and password.".
>
> This is typical of the classic SQL injection hack, and, indeed, of any
> hack where the attacker is able to inject scripting code and fool the
> backend into executing it. Typically by embedding quotes or the like in
> the input string.
>
> (For that matter, Steve's description also applies to binary injection
> via buffer overflow. But we won't go there; this page will talk only
> about non-buffer-overflow attacks, sijnce we have elsewhere described
> our agenda for preventing buffer overflow attacks.)
>
> Say that you are talking user input like NAME, and are somehow using it
> to create an SQL or other language command, like "SELECT FIELDLIST FROM
> TABLE WHERE NAME = '$NAME' ". But now the attacker, instead of providing
> a nicely formed string like "John Doe", provides instead something like
> "anything' OR 'x' = 'x ". (I added spaces between the single and double
> quotes for readability.) I.e. the user provides a string that contains
> quotes in the target language - not the language where the query string
> is composed, but a language further along. So the query string becomes
> "SELECT FIELDLIST FROM TABLE WHERE NAME = 'anything' OR 'x' = 'x' ". And
> now the query matches any row in the table.
> (http://www.unixwiz.net/techtips/sql-injection.html provides examples,
> as does wikip[edia.).

You had me until this point Andy, that's a pretty good explanation of 
SQL injection.
>
> The general solution to this is "quotification": take the user input,

And here is where you go wrong:

The general solution is to totally separate parsing from user input, 
i.e. in your example above you would first parse the SELECT statement, 
using question marks as placeholders for where you expect input.

Later on you execute that prepared (i.e. parsed) statement, substituting 
the actual user input for the placeholders:

I.e. in perl this looks like this:

   # Let the DB parser see only static strings like this:
   my $sth =
    $dbh->prepare("SELECT FIELDLIST FROM TABLE WHERE NAME = '?'");

   # Get the possibly poisonous user input
   my $user_input = param('name');
   $sth->execute($user_input);

[snip]
> Perhaps better to make taintimg the default. To flip the polarity of the
> special bit. And to require that language syntax, keywords, etcv., be
> set only if the special bit is set.

Perl actually has 'taint' as a builtin feature. :-)

Terje
-- 
- <Terje.Mathisen at tmsw.no>
"almost all programming can be viewed as an exercise in caching"

Back to comp.arch | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-12-08 07:26 -0800
  Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy Robert Wessel <robertwessel2@yahoo.com> - 2011-12-08 13:09 -0600
    Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy Quadibloc <jsavard@ecn.ab.ca> - 2011-12-09 10:55 -0800
      Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy Robert Wessel <robertwessel2@yahoo.com> - 2011-12-10 00:27 -0600
  Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy Terje Mathisen <"terje.mathisen at tmsw.no"> - 2011-12-08 22:40 +0100
    Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy Morten Reistad <first@last.name> - 2011-12-09 01:06 +0100
    Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy "Andy \"Krazy\" Glew" <andy@SPAM.comp-arch.net> - 2011-12-09 08:49 -0800
      Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy timcaffrey@aol.com (Tim McCaffrey) - 2011-12-09 20:19 +0000
      Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy Terje Mathisen <"terje.mathisen at tmsw.no"> - 2011-12-09 22:20 +0100
  Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy Joe Chisolm <jchisolm6@earthlink.net> - 2011-12-09 13:24 -0600
    Re: A_Modest_1_bit_Proposal_about_Quotification_-_making_the_Default_Easy Quadibloc <jsavard@ecn.ab.ca> - 2011-12-10 10:39 -0800

csiph-web