The Daily WTF: Curious Perversions in Information Technology

BlackTigerX · 2006-01-30 Reply Admin

the WTF is how many people can't see the problem, even with the title

2006-01-30 Reply Admin

BlackTigerX:
the WTF is how many people can't see the problem, even with the title

I don't see the problem either. Its just an extension of Spring style dependency injection all the way to the database.

dpm · 2006-01-30 Reply Admin

ptomblin:

When I was young and niave and not too long out of school, I was making $36,000 a year. My employer was charging me out to clients at $1000/day. Quick, work out the profit margin on *that* little transaction.

No profit at all, since you were only working thirty-six days a year. Sweet deal, wish I had been in on it.

ok
dpm

rbriem · 2006-01-30 Reply Admin

cconroy:
Is that XMSQL or SQXML? I can never tell the difference. Should've use JavaVBScript instead.

Now I'm marrying Jane from Susanville / Or am I suing Jane from Marysville? / Well if I am better call Ernie my attorney from Burney Falls ...

Sorry, today is random association day at work ...

2006-01-30 Reply Admin

dpm:

No profit at all, since you were only working thirty-six days a year. Sweet deal, wish I had been in on it.

ok
dpm

Holy shit, it's a disease. You actually sign your posts not once, but twice! Fucking brilliant.

sgtace · 2006-01-30 Reply Admin

How about using MSSQL FOR XML, then the users don't have to write SQL or XML. All query parts could be stored in the database, then the UI can present some controls, the user makes selections, clicks a button, XML is generated, and the XML file is stored on the network. Periodically the Entity Manager will search for new files and then run the queries and send the results to the user.

You now have a DataWarehouse with a user interface. Lauch it company wide as the new Data Consolidation Solution and give yourself credit for resolving the company's data consolidation issues.

2006-01-30 Reply Admin

Anonymous:
dpm:

No profit at all, since you were only working thirty-six days a year. Sweet deal, wish I had been in on it.

ok
dpm

Holy shit, it's a disease. You actually sign your posts not once, but twice! Fucking brilliant.

I'm sure you meant Brillant.

Paula,

Paula.

2006-01-30 Reply Admin

BlackTigerX:
the WTF is how many people can't see the problem, even with the title

The real WTF is why this forum software needs to use JAVASCRIPT to change from page to page, and why it calls its BBCode "HTML". ^o)

Aristotle Pagaltzis · 2006-01-30 Reply Admin

cconroy:
Is that XMSQL or SQXML? I can never tell the difference. Should’ve use JavaVBScript instead.

You mean JaVBaScript?

felix · 2006-01-31 Reply Admin

BtM:
I understand how crap like this happens. You need to get a solution working, and doing it the Right Way would take more time/money/talent than you have available, so you throw up something simple and dirty and pray no one notices.

Why, I do that every day - throwing up simple, dirty solutions (because our customers can't afford properly written software), but I never have to compromise on security. I don't see why anyone should.

Oh wait, people who abuse XML are the same who don't get XML. Something like <query proc="bills"><date><interval from="{SOMETHING}" to="{SOMETHING}"/></date></query> is beyond their comprehension, I guess.

I never needed to use XML. Perhaps because I *do* get it.

Cheers,
Felix

2006-01-31 Reply Admin

OneFactor:
...The company also told us that expensing shampoo and soap was unethical.

Sounds like a smelly 2 weeks

2006-01-31 Reply Admin

I think the biggest wtf here is that people miss the actual point and take their chance to complain about xml. According to my experience hating xml is usually strongly connected with ignorance, but hey! You can invent another text-format for every project you build and make a parser for it, for all I care. Ok, passing parameters as xml is quite dumb, but parsing the return value using xpath will be sweet!

Xargon:
Anonymous:
Whenever anybody says how great XML is, I just remind myself that XML is just a text file format. So if you take out "XML" and replace it with "text files" it sounds much less exciting and revolutionary.

Or you could insist on using the proper acronym and calling it "EML". EML doesn't sound as interesting as XML; maybe then it will lose some appeal...

ammoQ · 2006-01-31 Reply Admin

BtM:
I understand how crap like this happens. You need to get a solution working, and doing it the Right Way would take more time/money/talent than you have available, so you throw up something simple and dirty and pray no one notices.

Even if you throw up something simple and dirty, you should at least keep the interfaces clean enough so you have a chance to make the Right Thing later.

Arancaytar · 2006-01-31 Reply Admin

John Bigboote:

My guess is that it's distressingly simple. The badass query engine is nothing more than a SQL concatenator. It's designed to append elements to the WHERE clause by field. The sub-WTFery comes about because the concatenator was designed to concatenate " where " + fieldNameParam + " = " + valueParam; that is, searches by value, not range.

The {START_DATE} at the beginning is designed to ensure there's no SQL error, otherwise you'd have something like " WHERE create_date = BETWEEN '1/4/2005' AND '1/7/2005' ". This is what tips the gaff and indicates that the Emperor is nekkid.

e.thermal:
Cause they are taking the input and building a SQL statement, so the first 'date' welds well with 'WHERE DATE =' + passed in value. and then the 'OR Fieldname BETWEEN Then and Now' does the real work. Basically they are teaching their users to do SQL injection attacks against their own system.
Good WTF, nice and subtle as a Tuba.

Wait, wouldn't it be just awesome if the program did a check on that field to see whether it was an exact date or a date range, and then fix the SQL query on its own?

But fancy code like that tends to be brittle. Much better to go with a simple, robust system. :D

2006-01-31 Reply Admin

Sage CRM MME, a popular CRM system for medium-sized businesses, has a SOAP interface. It has two functions for fetching data. The first is innocent enough: you supply an entity type as a string ("company", for example) and then the numeric ID which is the primary key for that company in the database.

There is a second function which takes two parameters: (entityType, query). The documentation on the SOAP interface doesn't explain what goes in the "query", but it does say that it's a string. It turns out that this field contains some SQL which gets inserted verbatim after the "WHERE" keyword in the SQL query.

I had the "pleasure" of having to use this SOAP interface to integrate some stuff into our intranet for remote workers to access. Each time I used that second function I considered just throwing it all away and connecting to the database directly, since it's functionally equivilent, right?

2006-01-31 Reply Admin

The best WTF here is everybody explainig it a thousand times to demonstrate "they know".

ammoQ · 2006-01-31 Reply Admin

Anonymous:
The best WTF here is everybody explainig it a thousand times to demonstrate "they know".

DiamondDave asked. It's only natural that people answer to that before they read the whole thread. At least it's better to give serious answers than answering with "Isn't that obvious?" or something similar.

2006-01-31 Reply Admin

Anonymous:
BtM:
You know "The Scream", that famous Heironymous Bosch painting that appears everywhere (including the cover of "The Unix Hater's Handbook")?

I'm doing that right now.

I understand how crap like this happens. You need to get a solution working, and doing it the Right Way would take more time/money/talent than you have available, so you throw up something simple and dirty and pray no one notices.

Even so, someone should get sued over that.

"Hello, I'm a security hole. Please take advantage of me."

s/Heironymous Bosch/Edvard Munch/

_Know it_? The original is in my basement!

2006-01-31 Reply Admin

Rather looks like queries to the Siebel 2000 CRM system to me.

2006-01-31 Reply Admin

Rather looks like queries to the Siebel 2000 CRM system to me.

-----------------------------------------------------

You're just jealous 'cause the voices only talk to me!

2006-01-31 Reply Admin

Scary. At £1000/developer/day they could put some more effort into it. What's so complicated with extending the format so that it directly supports 'between' comparison?

<EntityQuery>
  <Entity Name="ClientContact">
    <Fields>
      <FieldBetween
        Name="ContactDate"
        LowValue="2003-04-01"
        HighValue="2003-04-30"
      />
    </Fields>
  </Entity>
</EntityQuery>

I really hope SQL is renamed to XQL some day, gets lots of hype and the people finally learn how to do the right thing with it...

jwenting · 2006-01-31 Reply Admin

jsumners:
Awesome! An XML SQL client. Why didn't anyone think of this before? </SARCASM>

who says noone thought of it before?

jwenting · 2006-01-31 Reply Admin

ptomblin:
Anonymous:
Is it me or is the real WTF the '£1000/developer/day'?

What the conslutant charges the client and what the conslutant pays his developers are two entirely different things. When I was young and niave and not too long out of school, I was making $36,000 a year. My employer was charging me out to clients at $1000/day. Quick, work out the profit margin on *that* little transaction.

That's normal. Your rented out at a thousand a day, and you get $36k a year. But you cost the company something like 3 times that (taxes, social security premiums, your lease car, laptop, other benefits that aren't on your paycheck).
That's 100K a year give or take.
Then there's the people the company doesn't rent out, maybe a third of the workforce. If they make on average the same again you're now costing $150K a year.
You now cost the company $150K a year to make a thousand a day for 170 days a year (assuming you're on site 50 weeks a year, 5 days a week, so minimal sickleave and vacation time).
Suddenly the profit they make on you is $20K out of $150K, 2/15. That's about13%, not bad but certainly not massive especially since it assumes 100% availability of you as an income generating asset (which is unrealistic).

2006-01-31 Reply Admin

In Spain there are no pesatas, there are €, and before there were pesetas. 2500 pesetas are ~ 20$

ammoQ · 2006-01-31 Reply Admin

jwenting:
That's normal. Your rented out at a thousand a day, and you get $36k a year. But you cost the company something like 3 times that (taxes, social security premiums, your lease car, laptop, other benefits that aren't on your paycheck).
That's 100K a year give or take.
Then there's the people the company doesn't rent out, maybe a third of the workforce. If they make on average the same again you're now costing $150K a year.
You now cost the company $150K a year to make a thousand a day for 170 days a year (assuming you're on site 50 weeks a year, 5 days a week, so minimal sickleave and vacation time).
Suddenly the profit they make on you is $20K out of $150K, 2/15. That's about13%, not bad but certainly not massive especially since it assumes 100% availability of you as an income generating asset (which is unrealistic).

I think a normal employee costs rather twice than three times his income. USD 72k per year for taxes, social security, lease cars and laptops? Even if taxes and social security amounted to 36k (which I doubt), the remaing 36k would easily buy you a new car every year and a new laptop every other month (and you could always throw away the old one).
On the other hand, the ratio between employees whose work can be sold for 1k/day and the other employees is often much worse than 2:1, rather 1:1 or even 1:2. Think of all the salespeople, the secretary, the managers, the cleaning women. The consultants in training or waiting for an assignment.

impslayer · 2006-01-31 Reply Admin

maldrich:
Folks seem to miss the subtle logic at work here:
...
Brilliant!

Was that pseudo typo intended?

(Yep, first post, trying to quote...)

2006-01-31 Reply Admin

Why does this remind me of:

name: admin password: ' OR '1'='1

ammoQ · 2006-01-31 Reply Admin

impslayer:
maldrich:
Folks seem to miss the subtle logic at work here:
...
Brilliant!

Was that pseudo typo intended?

(Yep, first post, trying to quote...)

"Brillant" is an insider joke in this forum. Look for the "the brillant paula bean" wtf.

impslayer · 2006-01-31 Reply Admin

ammoQ:
impslayer:
maldrich:
Folks seem to miss the subtle logic at work here:
...
Brilliant!

Was that pseudo typo intended?

(Yep, first post, trying to quote...)

"Brillant" is an insider joke in this forum. Look for the "the brillant paula bean" wtf.

Thus the question if 'Brilliant!' was a (pseudo) typo :)

forwardtech · 2006-01-31 Reply Admin

Screw the code, was Mike Barker the one who sold this project to management as in the quote "That, and the bargain-basement rate of £1000/developer/day, made the Entity Manager-based CRM system an install sell to management". If not, then who was the idiot who let this project even go for a year without noticing that this was simply a glorified SQL generation tool even if your the one who has to provide the correct SQL. Did this company even realize about the dangers of injection or did the Entity Manager take care of sql injection on it's end?

I could imagine quite a few people getting fired over allowing that disaster to even make it past the planning stages.

2006-01-31 Reply Admin

Anonymous:

[...]
BTW, if you had to maintain the API and fix the security hole, what would you do? I can imagine trying to do it by just changing the backend code to submit the dangerous query under a user account with really restricted permissions.

Isn't the database responsible for the security? A good setup of the DBMS should prevent the frontend attempting any malicious actions, but I'm no expert on this topic. Perhaps someone could enlighten me?

--
I hear voices in my head. And they don't like you!

2006-01-31 Reply Admin

lucky luke:
Anonymous:

Value="1 ; shutdown --"

ahh the sweet mayhem to be had by being allowed to inject my own sql statements through a hole in the API...

Value="1; drop database if exists main"

just cause I don't like people using the "main" database

It wouldn't suprised me if they were running the application with sa priveliges either.

2006-01-31 Reply Admin

Anonymous:
I don't get the "xml-abuse" comment - there's nothing in this WTF that is dependent on, or even encouraged by, XML.

It's not neccesarily XML that's WTF, but their misuse of it. Based on the description, they could have easily used:

Query{

 Field=Value;

 Field=Value;
 ...

They could have saved a lot of code and runtime by using a trivial custom parser instead of using a full blown XML parser. That's WTF #1. The way this query is processed is the main defficiency-- by simply dropping the value string into an SQL query. They then tried to cram a range query into this simple model when they ought to have extended the query syntax for ranges. WTF #2. In fact, this is an advantage of XML that they specifically did not use! The X is for Extensible. They could have very very easily eXtended their XML query format to include a way to specifically include a range of values. But they diddn't. The big WTF, and #3.

2006-01-31 Reply Admin

Isn't the database responsible for the security? A good setup of the DBMS should prevent the frontend attempting any malicious actions, but I'm no expert on this topic. Perhaps someone could enlighten me?

Yes and no.

It's kind of like if you setup a service listening to the unfirewalled internet that will download and run executables on demand. Sure the permissions system on the host should prevent any damage, but you should still be thrown against the wall and shot.

osp70 · 2006-01-31 Reply Admin

I wonder if the code Mike is looking at is the middle layer. The 'consultant' developed the front end that would prompt users to choose fields and their data, thereby releasing them of any required knowledge of xml, sql or abracadbra. Mike was developing an interface for 'his' system so he would need to side step the front end. So for him to develop code that would do sql injections would be to break his own code. I highly doubt that the end user is presented with the requirement to enter a 'sql' like query into a front end program, if so this company got rooked.

dpm · 2006-01-31 Reply Admin

jwenting:

That's normal. Your rented out at a thousand a day, and you get $36k a year. But you cost the company something like 3 times that (taxes, social security premiums, your lease car, laptop, other benefits that aren't on your paycheck).
That's 100K a year give or take.

That's a lot of overhead, but I'll let it slide for the sake of argument.

jwenting:

Then there's the people the company doesn't rent out, maybe a third of the workforce. If they make on average the same again you're now costing $150K a year.

Ditto.

jwenting:

You now cost the company $150K a year to make a thousand a day for 170 days a year (assuming you're on site 50 weeks a year, 5 days a week, so minimal sickleave and vacation time).

50 * 5 = 250
250 - 5 sickdays - 15 vacationdays = 230

Where did your extra 60 days go? Is ptomblin's health that bad?

ok
dpm

WTF Batman · 2006-01-31 Reply Admin

Anonymous:

<EntityQuery>
  <Entity Name="ClientContact">
    <Fields>
      <FieldBetween
        Name="ContactDate"
        LowValue="2003-04-01"
        HighValue="2003-04-30"
      />
    </Fields>
  </Entity>
</EntityQuery>

XML-INI!! Now we can embed XML with one of the formats it was supposed to replace! Quick, someone tell the PHBs!

2006-01-31 Reply Admin

Anonymous:
OneFactor:

...The company also told us that expensing shampoo and soap was unethical.

Sounds like a smelly 2 weeks

Frankly, if you are expensing soap and shampoo you are just taking advantage. No wonder all those companies in the 90s went out of business!

KraGiE · 2006-01-31 Reply Admin

YEAH MAN! I love it! Straight up sql inject yourself. Hey man. if all else fails.. HACK IT

2006-01-31 Reply Admin

jwenting:

ptomblin:
Anonymous:
Is it me or is the real WTF the '£1000/developer/day'?

What the conslutant charges the client and what the conslutant pays his developers are two entirely different things. When I was young and niave and not too long out of school, I was making $36,000 a year. My employer was charging me out to clients at $1000/day. Quick, work out the profit margin on *that* little transaction.

That's normal. Your rented out at a thousand a day, and you get $36k a year. But you cost the company something like 3 times that (taxes, social security premiums, your lease car, laptop, other benefits that aren't on your paycheck).
That's 100K a year give or take.
Then there's the people the company doesn't rent out, maybe a third of the workforce. If they make on average the same again you're now costing $150K a year.
You now cost the company $150K a year to make a thousand a day for 170 days a year (assuming you're on site 50 weeks a year, 5 days a week, so minimal sickleave and vacation time).
Suddenly the profit they make on you is $20K out of $150K, 2/15. That's about13%, not bad but certainly not massive especially since it assumes 100% availability of you as an income generating asset (which is unrealistic).

Lease car??? THAT is the real WTF. What kind of company gives those perks anymore? (Or ever did...)

2006-01-31 Reply Admin

The funniest thing is that the proposed solution isn't even working correctly if ContactDate stores time information together with the date part.The correct way would be

Value="2003-04-01' OR ContactDate BETWEEN '2003-04-01' AND DateAdd(day, 1, '2003-04-30')"

foxyshadis · 2006-01-31 Reply Admin

OneFactor:
ptomblin:
Anonymous:
Is it me or is the real WTF the '£1000/developer/day'?

What the conslutant charges the client and what the conslutant pays his developers are two entirely different things. When I was young and niave and not too long out of school, I was making $36,000 a year. My employer was charging me out to clients at $1000/day. Quick, work out the profit margin on *that* little transaction.

Reminds me of when my company sent me to the states billing at $125 US / hour while still paying my regular salary in Canadian dollars. And then when you add the overtime hours that get billed to the client without any effect on my compensation, it must have worked out quite well. The lead developer put in 80 hours a week for two weeks straight billing at $125 / hour. The company bought him a T-shirt to recognize his hard work. The company also told us that expensing shampoo and soap was unethical.

Your chunk of Canada must have the worst IT industry in north america, or else you were just too young to pick up and take off. You should have cut a deal with the client to halve his hours, if he'd give you 30-40% of the savings, and use the pickings to walk away and find something better or start your own thing. :p

Otto · 2006-02-01 Reply Admin

(picks jaw off the floor)

This leads to an interesting philosophical conundrum. If you document a security hole as standard practice, then is it still a bug? I mean, obviously somebody should be punched for such a thing, but still...

2006-02-01 Reply Admin

Otto:

(picks jaw off the floor)

This leads to an interesting philosophical conundrum. If you document a security hole as standard practice, then is it still a bug? I mean, obviously somebody should be punched for such a thing, but still...

Well actually now its a 'feature'... yeah thats the ticket.

2006-02-02 Reply Admin

lol!

That's funny cos, Sage CRM (formerly Accpac) does exactly the same.

public string GetPhoneNumber(int companyId)
{
Connect();

string phoneNumber = string.Empty;

crm.ewarebase[] phone = binding.query("Phon_CompanyID = " + companyId.ToString() + " AND Phon_Type = 'Business'","phone").records;

crm.phone p = (crm.phone)phone[0];

   phoneNumber = p.areacode + " " + p.number;

   return phoneNumber;
  }

mwaahahhahaha

2006-02-02 Reply Admin

Anonymous:
lol!



That's funny cos, Sage CRM (formerly Accpac) does exactly the same.



public string GetPhoneNumber(int companyId)
 {
 Connect();

 string phoneNumber = string.Empty;

 crm.ewarebase[] phone = binding.query("Phon_CompanyID = " + companyId.ToString() + " AND Phon_Type = 'Business'","phone").records;

 crm.phone p = (crm.phone)phone[0];

 phoneNumber = p.areacode + " " + p.number;

 return phoneNumber;
 }

mwaahahhahaha

Actually, that fine, as it's defined as an int in the function declaration. So trying to feed in "10; drop database" will die before it even gets into this function.

Sorry to burst the bubble there.

Solution Injecting

Leave a comment on “Solution Injecting”