Skip to content

injection

The database is not a source of trust

Second-order injection: a value stored safely and used unsafely.

The first query bound its parameter and stored the value correctly. Nothing about that request was wrong. A later request reads the value back and puts it into a statement by concatenation, and the whole defect is that nobody looked twice at a value that had come out of their own database.

It is worth being precise about why that reasoning is wrong. A database is not a source of trust; it is a place values were put. Whatever went in is what comes out, and what went in came from a request.

  • POST /profile

    Stored, and nothing happens. This request is fine — it binds its parameter.

  • GET /me/namesakes

    A different request, carrying nothing. Watch the statement the store parsed.

This build

id.example.com

Nothing sent yet. Every request goes to the application in this tab and nowhere else.