What's being debated is what is "computer code", and whether this legislation makes any sense at all.
What they actually seem to want is to ban company names which could cause damage or disruption to the Companies House IT system. I'd be surprised if that wasn't already banned in some way or another.
Of course, the thing about law is that it is administered by humans and not computers, so there is some scope for common sense to override the strict letter of the law.
Honestly I wouldn't be surprised if some of the algorithmic trading firms are using GPT-4 or LLaMa-2 for some sentiment analysis tasks, in which case this might actually work.
On a slightly more serious note, that has to be securities fraud, somehow? Right?
https://www.wired.com/story/null-license-plate-landed-one-ha...
Do they not track the names of foreign companies either?
It turns out, even if Companies House computer systems are 100% secure, the same isn't true of downstream systems. Unfortunately, Companies House has decided that telling downstream systems to git gud isn't enough.
I’m sure some will object to this as “big government gone mad” or whatever but it feels pretty common sense to me to at least try. No one actually needs to name their company after a SQL statement.
Companies House data is consumed by a very large number of companies and organisations, some of whom probably are vulnerable to such attacks. Fixing them isn't something Companies House can do. The joke Bobby Tables company name that was registered deliberately wasn't actually a functioning SQL injection. If someone does try to register a name containing a real one, it seems like a good idea for Companies House to be able to reject it on those grounds. This is just giving them that ability, as part of a larger ability to reject names that are designed to mislead or facilitate fraud.
The knee-jerk HN Nelson laugh at everything the UK and EU governments do makes for tedious reading, especially when there are so many actually bad policies and laws to criticise.
Maybe it'd be better to deliberately include some Bobby Tables entries in every data set to make sure users think about these problems early-on, but it's probably too late for that.
Regardless, anyone affected by a "bobby tables" should be thankful it was that, and not hackers exfiltrating their data and selling it.
Proper query building and sanitization is the only reasonable solution.
(the most annoying part is that I'd change it if I could because it has no value to me and is just a pain, but that my government doesn't allow it... :-/)
I'm never quite sure what to do on offline forms that have boxes for characters that run out, I normally just continue writing past the boxes, but at least one official government documentation has been addressed to me just missing the second one.
And a few things seem to handle having multiple middle names (and thus middle initials) poorly, ignoring the length.
This lasted about 5 years before it was reversed. I met someone who had this in her last name and thought she was yanking my chain.
I'm so sorry my country did this.
Here is something in French that mentions the law, I couldn't easily find the original law online:
https://www.senat.fr/questions/base/2011/qSEQ110418181.html
Now that I think about it, it's entirely possible that it caused some issues with SQL.
It allows : / . < > and " though which is enough to allow XSS.
Strangely, though, they don't allow lower case letters.
And yes, you can register a company named > LIMITED and someone has https://find-and-update.company-information.service.gov.uk/c...
especially since input sanitization is cheaper than free these days. any libraries/orms/whatever made in the last 15 years that is worth actually using will do this by default, and usually make it a pain in the ass to turn off.