Comments (2)
Password hashing isn't really the issue. The issue is that there were several SQL statements assembled like this:
query = "DELETE FROM users WHERE uid IS '" + uid + "'"
db.execute(query)
If I could somehow control my UID to be ' OR true() OR '
, that statement becomes:
DELETE FROM users WHERE uid IS '' OR true() OR ''
and I've just wiped out your users table.
I edited all the functions doing DB access to use prepared statements, like so:
query = "DELETE FROM users WHERE uid IS :uid"
db.execute(query, { "uid" : uid })
which is impossible to do an SQL injection into.
This is what PR #64 is about. (PR #64 also does other stuff, like using context managers for all DB functions to get safe commit-or-rollback semantics.)
from snowboard.
PR #64 resolved all SQL injection issues in code that existed before it was branched, but some stuff was changed while it was being written.
So snowboard is not yet SQL-injection safe. I will fix the remaining stuff ASAP.
from snowboard.
Related Issues (20)
- Flood Protection
- Ping Command
- Add PM versions of Trace/Seen
- Add Dice Module
- Leverage ChanServ Identification
- Username/Password Ident
- Add Command for Bot to Generate Hostmask
- Console Channel
- Handle Being Kicked
- Handle Invite Only
- Handle Invites
- Change INI Configuration from IRC
- Identity Commands
- Properly Deal with Host Information in NAMES HOT 1
- Deal with Half-Ops
- Keep Track of Channel Modes / Default Modes
- Make ^seen database Auto Search
- Correct grammar for when a setting is cleared.
- Bot Crashed on an Action Command containing a Channel HOT 3
- Use daemon tools to daemonize Snowboard
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from snowboard.