Hacker News Reader

Comment by FabHK | Hacker News Reader

SQL injections are in there, and server injections as well.

For example (I trust HN is suitably hardened :-) :

  /dev/null; touch /tmp/blns.fail ; echo
  1;DROP TABLE users

Edit: PS: "Feel free to send a pull request to add more strings, or additional sections."

View on HN

I noticed earlier in the file that the Javascript had been chosen to be benign. "DROP TABLE users" doesn't seem to fit with that spirit. I'd want it to be instantly evident but also non-destructive, or at least reversible. How about renaming the table instead?

(Sure, people generally shouldn't use this test input outside of a discardable testing environment, but if we could rely on "People shouldn't..." clauses to govern behaviour then much of this list would be unnecessary anyway.)

Already an issue: https://github.com/minimaxir/big-list-of-naughty-strings/iss...

Comment by the reporter of that issue (ro31337):

> "Dropping a table is like checking a gun without bullets. It should not work, but just don't put it against your head while testing."

I trust HN is suitably hardened

HN doesn't use a database.

How does it store comments?

As files on disk. An old version is open source, available from http://arclanguage.org/install

It's written in Arc though, so it may take some effort to read.

Reply on news.ycombinator.com