Tag Info

New answers tagged

2

Disclaimer: this is my layman understanding. I am not involved or educated in anything like this. Consider my answer to be somewhat untrustworthy. I have no legal knowledge or training. This is fairly basic software forensics, which has plenty of overlap with software reverse engineering as far as the technical skill set is concerned. It is not sufficient ...


1

I would vote in favor #1, because I find it slightly easier to understand what's going on and control the behavior. We used this approach to build a fairly large enterprisey apps without too much fuss. It also is easily customizable, if needed (e.g. would 1 token per user suffice? Would you need multiple token if user simultaneously logs in from multiple ...


1

In general you can't release an open source project if: it breaks a criminal law, it breaks intellectual property law and and intellectual rights (such as protected by patents) it contains copyrighted content part of it it's not your own work and it conflicts with other licenses it contains some sensitive data, but you can always encrypt it (e.g. using ...


1

First of all, don't put REST above solving problems efficiently. In order for clients to be able to log in you need to somehow store some state. Whether or not you consider this to be against the REST mantra doesn't really matter, you need to do it anyway. You could make digitally signed tokens containing all session information, and not store those on the ...


5

The statelessness of REST refers to the side of the server. If you pass around your token in every request this becomes part of the state that is being sent from the client and therefore does not violate the statelessness of your server. This differs from, for example, managing state on the server where you keep information in the session server-side. A ...


1

Every language has a runtime which connects your code with the outside world. In the case of Java and .NET, this runtime includes a security model. E.g. if a Java application wants to open a file, that request has to pass through the runtime. The runtime can then deny that request. Note that this is not implemented on a library level within the language, but ...


4

TL;DR: You'd have to restrict all literals, not just the ones in WHERE clauses. For reasons why they don't, it allows the database to remain decoupled from other systems. Firstly, your premise is flawed. You want to restrict only WHERE clauses, but that's not the only place user input can go. For example, SELECT COUNT(CASE WHEN item_type = 'blender' ...


12

SQL injection occurs when a query is built by concatenating text from an untrusted and unvalidated source with other portions of a query. While such a thing would most often occur with string literals, that would not be the only way it could occur. A query for numeric values might take a user-entered string (that's supposed to only contain digits) and ...


44

There are too many cases where using a literal is the right approach. From a performance standpoint, there are times that you want literals in your queries. Imagine I have a bug tracker where once it gets big enough to worry about performance I expect that 70% of the bugs in the system will be "closed", 20% will be "open", 5% will be "active" and 5% will ...


7

SELECT count(ID) FROM posts WHERE deleted = false If you want to put the results of these in the footer of your forum you would need to add a dummy parameter just to say false every time. Or the naive web programmer looks up how to disable that warning and then continues on. Now you can say you would add an exception for enums but that just opens the hole ...


2

Already proposed and being implemented in most major browsers. It's called: Sub Resource Integrity Subresource Integrity (SRI) allows specifying the digest of the file that you want to include. The digest is the output of a cryptographic hash function, which helps us achieve integrity. A nice overview is available here by one of the co-authors of the ...



Top 50 recent answers are included