Hacker News Reader

Comment by crazygringo | Hacker News Reader

How the heck does a bug with a single quote make it past QA, let alone crash an app?

I was expecting some kind of SQL injection, which you could at least understand as a result of incompetence. Or I can similarly understand UTF-8 bugs or whatever.

But it's not like O'Brien is an uncommon name. I don't know if I'm more mystified by the fact that this made it past testing, or that rather than the reservation lookup just returning no matches it actually crashes.

I'm really trying to imagine what possible code could be crashing. I guess my best guess is an off-by-one error in a function trying to escape strings for use in a SQL query, that leads to inserting infinite quotes and running out of memory. But then I can't imagine who would be writing their own escaping function...

View on HN

A QA engineer walks into a bar and orders a beer. He orders 2 beers. He orders 0 beers. He orders -1 beers. He orders a lizard. He orders a NULLPTR. He tries to leave without paying.

Satisfied, he declares the bar ready for business.

The first customer comes in and asks where the bathroom is. The bar explodes.

In 2017 Apple had a vulnerability in Mac OS Sierra that allowed anyone to unlock a computer using the user name “root” and no password.

In 2018 Apple became the first company to reach a market capitalisation of one trillion dollars.

So — in answer to “How the heck does a bug with a single quote make it past QA, let alone crash an app?”

Humans aren’t really as clever or discerning as we claim to be.

> How the heck does a bug with a single quote make it past QA, let alone crash an app?

I've reviewed code where the Linux kernel documentation states the function WILL return -1 if the feature is disabled, pointed it out in code review, they merge it later (completely ignoring my comment), then get the ticket where the user had disabled the feature in their micro-kernel and the app crashes.

Sometimes, it's like some devs just don't care about the unhappy paths.

I am an eternal optimistic developer, I don't have any unhappy paths :)

It’s not a bug, just a happy little accident

At SpaceX we call it success

"Happy-path gets all the love."

QA costs money. Why would you spend that money? The clients are captive: replacing the system would mean replacing every room lock which is serious cost and hassle.

I've added infinite loops to error paths to hang the process in a state where a debugger can be attached for further inspection, but those never went into something meant to be released. Maybe that happened here.

Sounds like it is time to link to “ Falsehoods Programmers Believe About Names”:

https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...

> I guess my best guess is an off-by-one error in a function trying to escape strings for use in a SQL query,

I don't think it was crashing, but a few years ago I fixed a bug on the app I'm working on, where we had issues with apostrophes in names with SQL Server (where single apostrophes in strings have to be escaped with another one); as it turned out, another dev had written a buggy replace function, the fix was just to use the replace built in the standard lib. I don't think the dev had written a full escaping function, it was just a method to deal with the apostrophes.

Also in these unstaffed hotels with kiosk checkin did every O’Brian just fail to check in with no recourse in a hell of automated systems? It’s clear there was no escalation path or this would have been caught sooner right? In the end it was the kiosk manufacturer that was informed by the pen tester but all that time in an entire chain of hotels O’Brians were just left hanging with no recourse.

Used to be you could crash the Home Depot POS app (same one is used for employees and self-checkout) by simply not entering in a PO number. Pretty impressive for a company that targets home gamers.

It's much more likely that O'Leary is improperly processed than it is, even by multinationals with years of experience, millions of customers, you name it.

I was surprised Ryanair (who you would expect to be top of the list for cut price software given everything else about them) handles this correctly… but then remembered the name of the CEO.

They funded the QA by charging every customer with an apostrophe in their name an extra 5 euro.

Probably 3/4 of their Irish staff would find the bug

Reply on news.ycombinator.com