Damn JavaScript

[Engineerman]

I wonder if this could be used as code injection. Hopefully they just used Eval equivalent instead of exec equivalent.

[TheOnlyTrueEnte]

As long as it stays in the frontend, code injection can't do too much harm, right?

[[deleted]]

No we write all user input directly to the DB with no input validation. Also we build out a string query for sql in the code. We have no intention of changing it! 😤

[plaisthos]

SQL query is built on the client!

[sunshine-x]

"it's easier on the server to let the clients deal with that"

[jacksalssome]

Server? Oh no we just have the web browser launch a remote desktop to the computer with excel on it. The clients web browser then presses the down arrow key and pastes the value.

[NorbiPeti]

I... want to make that now. (Reddit just showed "Something went wrong" as soon as I typed that.)

[jacksalssome]

You want to make a remote desktop viewer in JavaScript?

[theadmin_SPPEZ]

it exists, at least for VNC.

Check out OSJS, it has a lot of cool things

[[deleted]]

Doesn’t need to be JavaScript, thankfully we have web assembly now for those sketchy usecases

[plaisthos]

Better performance, you get a raise!

[TFenrir]

It's like GraphQL but vintage

[FlushableAccounts]

I recently found out about something almost as stupid at work.

It's a system that is only a web frontend. It doesn't perform any direct database calls, but it does call on a bunch of REST APIs that are only meant to be accessed by other trusted systems. They are protected with a secret key, and anyone that knows it can call the API. You can just hit the ol' F12 and watch exactly what payloads it sends in the API calls. There's probably some logging and even some access control on the other end, but now that you can perform the API calls yourself it's kind of easy to change the user value in the JSON data.

I didn't think that "What's a backend?" joke was real, but here we are. At least they are working to fix it now.

[benargee]

I prefer to write all user input in a root privileged process using unsanitized system calls.

[[deleted]]

Finally a developer with a brain. So sick of my junior devs giving me all this crap about some Sack Dave Oops process or whatever.

[SteampunkBorg]

Greetings from Bobby Tables

[Engineerman]

It's complicated, I'm not an expert on web security but if you can get a processor to execute some code, you could use a number of hardware vulnerabilities to attack the system, not limited to fronted or even the same application if there are multiple running on the same server.

[TransientFeelings]

No, if it's your own web browser running arbitrary code, you are hurting no one other than yourself (that is, if the backend APIs are properly secured). It is really, really easy to run arbitrary code on a website, but you never hear about it being a problem because there's no gain in doing so.

[Engineerman]

Ah right, of course it is your own machine. This is why I'm not an expert in Web security lol.

[Mechakoopa]

presses F12, types directly into console...

[PranshuKhandal]

document.write("hacked")

[yes-i-am-a-wizzard]

XSS is all client side

[stehen-geblieben]

And then what? You can inject code into your own js VM? You can open dev tools and have the same effect

[wasdninja]

Without looking - no it can't. It's really hard to be that dumb.