Line 53 of https://github.com/fastmonkeys/stellar/blob/master/stellar/operations... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

swehner on Aug 22, 2014 | parent | context | favorite | on: Show HN: Stellar – Git for PostreSQL and MySQL

Line 53 of https://github.com/fastmonkeys/stellar/blob/master/stellar/o... is

                CREATE TABLE %s.%s LIKE %s.%s

This made me think of a table called

                create table `a; drop table users;`  (col int);

... which works in mysql.

I don't know if the stellar code will trip over something like this. But mysql (SQL) shouldn't even allow names like that.

obsession on Aug 22, 2014 [–]

Yes, Stellar will probably trip over this. Similarly, if the attacker can edit stellar.yaml, they probably can edit your .bashrc as well.

Im adding this to my TODO list.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact