1

I'm curious what the community thinks of inserting public service messages as comments when analysis shows they might be warranted.

I ran across Firefox does not insert data in MySQL database on occassion, and it clearly suffers an injection. Based on the tags, the MySQL code, and the lack of both PHP Data Objects and MySQLi bind_param, its fairly evident its the case.

As a security guy, I would love to see a Stack Overflow Bot (SOB) insert a message similar to:

This is Stack Overflow's SOB. Your PHP and MySQL code could be subject to injection based on an analysis of the code you presented. You should visit How can I prevent SQL-injection in PHP? to ensure its not the case.

SQL Injection consistently makes the OWASP Top 10, and this is an opportunity for Stack Overflow to make a real difference. Every programmer who triggered the bot would get a message educating them about it.

Stack Overflow already performs analysis on posts, so there's nothing ground breaking about it. In this case, the twist seems to be to look for both something and the lack of something else.

Also, by inserting the comment on "at risk" code, those who copy and paste it might be warned about blindly doing so. Using code you don't fully understand is a lot like password reuse. We know it should not be done, but it happens more frequently than it should.

I understand there are some downsides, but the upsides could have huge payoffs. At minimum, folks like you or I (and our families) end up in these systems, so maybe we would be at less risk than otherwise.

What does the community think?

4
  • 3
    A lot of users already do this manually (with prepared comments), but of course questions still slip through the cracks.
    – Artjom B.
    Commented Apr 8, 2015 at 6:38
  • @ArtjomB. it's a bit like the close vote queue. The number of users who do this is nothing compared to the ton of crap that ends up here every day. It also feels like a lost cause, I used to be nice and leave such comments but today I just downvote/close vote and move on.
    – user2629998
    Commented Apr 8, 2015 at 10:34
  • 1
    "SOB" is probably not the best choice of acronym.
    – jscs
    Commented Apr 8, 2015 at 18:53
  • I'd change it to Your PHP and MySQL code could be subject to injection based on an analysis of the code you presented. You should immediately stop writing code in such a horrible language against such a terrible database
    – user1228
    Commented Apr 8, 2015 at 19:19

1 Answer 1

3

Slippery slope argument, but: where would this stop?

  • "It looks like you're trying to perform a string split with a regex, are you sure?"
  • "You don't want to reinvent HTTP over sockets yourself, use libraries to talk to an HTTP server".
  • "This (lack of) level of abstraction is not maintainable on the long run".
  • "No, you don't want to use reflection for this".
  • and so on.

Every piece of code posted here, even if it's a single line, can have many issues with it. Not only with the code itself, but the design behind it. One opening more serious vulnerabilities than the other.

We're not here to educate every poster on every aspect of the code they post about, as we'll have to repeat parts of it for every question. The problem is bound to be explained in another question already.

If you're still manually crafting SQL or HTTP in 2015, you're behind on your education. I don't think it's SO's responsibility to fix that by putting an automated warning on each question.

6
  • 2
    "I don't think it's SO's responsibility to fix" - agreed. I also think it's way more problematic that there are existing, accepted answers with hundreds of upvotes which contain SQL injections and other vulnerabilities, and SE does nothing to prevent anybody from using them. Suddenly comments (which are, like we're always reminded, second class citizens) are deemed enough to deal with such a crap post. Instead of thinking about how to warn people of code in future answers/questions, cleaning up the crap that's already on SO and spreading bad practices every day would be far more important.
    – l4mpi
    Commented Apr 8, 2015 at 11:33
  • 1
    Or, you know, read an answer and apply its teachings to your own code, as opposed to expecting a copy-paste ready solution.
    – CodeCaster
    Commented Apr 8, 2015 at 11:35
  • 1
    Of course, but sadly you can't expect people to do that, especially if they have no idea what they're doing and just see an answer with a score of >500. I personally don't care all too much about this (I'm for letting people shoot themselves in the foot if they don't apply critical, rational thinking to what they're doing, especially if it involves copying anything from the internet), but from OPs perspective, the existing answers seem to be a much worse problem.
    – l4mpi
    Commented Apr 8, 2015 at 11:42
  • It's definitely not SO's responsibility to fix stupid "developers", but if we can help, why not ? An automated comment won't hurt anyone.
    – user2629998
    Commented Apr 8, 2015 at 12:13
  • @André and that's my point exactly: you can't expect to post "This code may be malicious because X" to every answer, but every answer contains flaws in one way or another. That may not be hurting anyone, but it's not very useful either, apart from the question of how you would properly implement that.
    – CodeCaster
    Commented Apr 8, 2015 at 12:24
  • Why is it not very useful ? In the long run it will make users write better code; some of them just don't know better because they followed outdated/low quality documentation, and a comment "this code is vulnerable to X vulnerability" will encourage them to search for "how to fix X vulnerability" and fix their code.
    – user2629998
    Commented Apr 8, 2015 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .