Comments on: We Don’t Need SQL Injection Anymore…

By: Jan

Jan — Sat, 14 Jun 2008 11:26:59 +0000

It’s emerging software, no support, use at your own risk. For me it’s intresting idea which needs work.

By: Giorgio

Giorgio — Sat, 14 Jun 2008 10:55:49 +0000

@Slim Amamou: yes, NYT's DBSlayer is quite similar in concept. But NYT folks are running their bridge as a separate and private load balancing daemon (port 9090 by default), and they don't suggest to query it directly from the client. Their samples are in PHP and Ruby, server side indeed.

By: Slim Amamou

Slim Amamou — Sat, 14 Jun 2008 10:26:47 +0000

looks like dbslayer for ODBC http://code.nytimes.com/projects/dbslayer

By: links for 2008-06-13 | Yostivanich.com

links for 2008-06-13 | Yostivanich.com — Fri, 13 Jun 2008 07:34:21 +0000

[…] hackademix.net » We Don’t Need SQL Injection Anymore… This is stupid, allowing javascript to exucute sql queries, client side is rife with issues. (tags: javascript security sql ibm) […]

By: Giorgio

Giorgio — Thu, 12 Jun 2008 22:56:23 +0000

@foo:
DBC-JS, as you can see by the source code, the demo and the paper, allows usage of prepared statement and stored procedures, but does not enforce it.
Even the example at the end of the paper is “select * from books” entered in a browser input box.
Guess what the underpaid junior developers who can “understand only a few abstractions” are going to do?

By: klurf

klurf — Thu, 12 Jun 2008 22:40:12 +0000

Lol,its worth to read the research report
http://domino.watson.ibm.com/library/cyberdig.nsf/papers/507FDDAF5626498B852572B200540AA2/$File/RC24217.pdf

"The DBC-JS API requires that clients authenticate themselves to the server with a name and password
when first establishing a connection to the server.
These credentials are passed on each message from
client to the server which authenticates the client on a per.message basis."

XSS?

"DBC_JS prevents SQL injection atatcks by
using a prepared statement API. Since the parameter values are never parsed as SQL,
injection attacks cannot occur"

2nd Level injection?
Not to mention DOS Attacks

Not to mention the idea in general to make business logic at client site.
Example source form the PDF:

if (validPassword)
continueWithApplicationBusinessLogic()

By: foo

foo — Thu, 12 Jun 2008 22:32:52 +0000

Well, as far as i see, its not that bad. They use stored procedures (and you have some degree of control what procedures may be called - there’s a whitelist of OK ones). So you can’t inject arbitrary code.

Well I dont say I would use a bank that uses this kond of technology, but for some low-security applications - for example some CMS it might be nice (i imagine that this kind of code is written fast).

But I’m not a website security expert. And I’d like to see conceptual example of hack using stored procedures.

By: ascii

ascii — Thu, 12 Jun 2008 19:03:30 +0000

Just. Amazing.

By: remy

remy — Thu, 12 Jun 2008 18:48:33 +0000

are they crazy?

security and javascript access to databases? Yes, Ying and Yang :P

I hope nobody new to web technologies use this crap.

It’s a pity that they have no real time demos :D

happy hacking ;)