Never trust user input

[txrandom]

Just sayin'.

 

[Leros]

I never validate input

 

[Newbian]

What about output?

I won't flush and let you check it out if that's ok with you.

 

[her209]

That's why I pipe the output into the input.

 

[TruePaige]

Hmm..is this about XSS injections? I'll have to look closer.

If so it is easy to patch up if it is just the one hole.

 

[destrekor]

Originally posted by: her209
That's why I pipe the output into the input.

:shocked:

my god man

 

[txrandom]

Originally posted by: TruePaige
Hmm..is this about XSS injections? I'll have to look closer.

If so it is easy to patch up if it is just the one hole.

It could be.

 

[Red Squirrel]

I had a teacher in my php class that did not bother teaching validation. When coding a login system he said just storing the userid in a cookie is good enough "because you had to authenticate to get that cookie anyway". cookies are user input too, people just don't really see it that way.

Drop down menues, check boxes, are all user input too, even though they are "restricted". I use restricted very loosely here and the avatar selection drop down in the profile page here is a great example of why.

Actually when it comes to potential SQL or html injections I find the easiest way is to simply turn < > ' " ` into the &nnn counter part. (I have a feeling this post wont submit very well )

 

[paulney]

I have a screenshot for the lulz.
Before the lulz ended.

 

[IEC]

I posted a PSA in the Programming forum reminding people to sanitize their inputs...

 

[MrPickins]

LOL

I was thinking something very similar.

 

[paulney]

Originally posted by: Spartan Niner
I posted a PSA in the Programming forum reminding people to sanitize their inputs...

The clock is ticking.

 

[Chronoshock]

There's a thread in TFI to followup on the incident. My guess is that there are many more attack vectors through input manipulation.

 

[IEC]

Originally posted by: paulney

Originally posted by: Spartan Niner
I posted a PSA in the Programming forum reminding people to sanitize their inputs...

The clock is ticking.

I am aware, so I will comply 23 hours and 59 minutes from T-start.

Mods, please forgive me for loving my alma mater.

 

[Newbian]

Originally posted by: Spartan Niner

Originally posted by: paulney

Originally posted by: Spartan Niner
I posted a PSA in the Programming forum reminding people to sanitize their inputs...

The clock is ticking.

I am aware, so I will comply 23 hours and 59 minutes from T-start.

Mods, please forgive me for loving my alma mater.

I do notice that the page is continual loading with some of these custom avatars.

 

[TruePaige]

Custom avatars are funny, eh..wonder if it had anything to do with starting this thread...

 

[Red Squirrel]

Actually I wonder what sparked this to begin with. That exploit has been there forever. What's funny is I had a feeling once but never bothered to try. I had seen someone with a blank avatar and found it was weird so I checked the source to see it was really lack of image then checked the code for the profile and saw image names. Funny stuff.

I hope fusetalk is at least free software... I would hate to be a sucker paying for something with such simple easy to avoid flaws.

 

[IEC]

Originally posted by: RedSquirrel
Actually I wonder what sparked this to begin with. That exploit has been there forever. What's funny is I had a feeling once but never bothered to try. I had seen someone with a blank avatar and found it was weird so I checked the source to see it was really lack of image then checked the code for the profile and saw image names. Funny stuff.

I hope fusetalk is at least free software... I would hate to be a sucker paying for something with such simple easy to avoid flaws.

I'm afraid it's not...


FuseTalk Basic Edition (CF) ******* $1,298.00
FuseTalk Standard Edition (CF) **** $4,298.00
FuseTalk Enterprise Edition (CF) *** $6,898.00
FuseTalk Basic Edition (.NET) ****** $1,298.00
FuseTalk Standard Edition (.NET) *** $4,298.00
FuseTalk Enterprise Edition (.NET) ** $6,898.00

 

[GeekDrew]

Obligatory reference:

http://xkcd.com/327/

 

[El Guaraguao]

My name is Bo Jangles and I have a bowflex body.

 

[adlep]

.net and cf
For The Fail (FTF)

 

[IEC]

Originally posted by: Newbian

Originally posted by: Spartan Niner

Originally posted by: paulney

Originally posted by: Spartan Niner
I posted a PSA in the Programming forum reminding people to sanitize their inputs...

The clock is ticking.

I am aware, so I will comply 23 hours and 59 minutes from T-start.

Mods, please forgive me for loving my alma mater.

I do notice that the page is continual loading with some of these custom avatars.

Fusetalk was trying to load a directory/image that didn't exist. Fixed.

 

[Red Squirrel]

Originally posted by: Spartan Niner

Originally posted by: RedSquirrel
Actually I wonder what sparked this to begin with. That exploit has been there forever. What's funny is I had a feeling once but never bothered to try. I had seen someone with a blank avatar and found it was weird so I checked the source to see it was really lack of image then checked the code for the profile and saw image names. Funny stuff.

I hope fusetalk is at least free software... I would hate to be a sucker paying for something with such simple easy to avoid flaws.

I'm afraid it's not...


FuseTalk Basic Edition (CF) ******* $1,298.00
FuseTalk Standard Edition (CF) **** $4,298.00
FuseTalk Enterprise Edition (CF) *** $6,898.00
FuseTalk Basic Edition (.NET) ****** $1,298.00
FuseTalk Standard Edition (.NET) *** $4,298.00
FuseTalk Enterprise Edition (.NET) ** $6,898.00

WTF seriously? That's retarded, who actually pays thousands for software when there's free alternatives? Not to mention use .net for a web app, LAMP is where it's at.

 

[txrandom]

Originally posted by: adlep
.net and cf
For The Fail (FTF)

It doesn't have anything to do with .net or cf. It could have easily been an issue in PHP powered forums.