Drive your web dev nuts and use [object Object] as user name
this post was submitted on 11 Sep 2023
-2 points (0.0% liked)
linuxmasterrace
2166 readers
1 users here now
A community for Linux enthusiasts.
May your htop stats be low and your beard grow long
Welcome to [email protected] former r/linuxmasterrace members and existing Lemmyverse citizens: Feel free to join the newly created [email protected] community.
Let’s make the full transition to the decentralized Fediverse!
founded 1 year ago
MODERATORS
OK, I guess it's some sort of sql injection, but what does that actually does?
Not really - a SQL Injektion would be naming my user user"; DROP TABLE USERS;-- or something like that.
My string is harmless but might scare web devs: How often do you see pseudocode like this?
log(INFO, "User "+user.userID+" logged on")
Usually this should print User @[email protected] logged on as the variable content gets converted to a string. But if the variable is not a simple datatype like string, but a complex one, there might be errors. If you do the concatenation above with an object instead of a string, this would only print User [object Object] logged on. Now when the web dev sees this line he's going to try to find the Bug, where this variable gets set to the wrong value/type, when in reality it's just your carefully crafted user name.
And don't forget to always use password as your password!
🤡
Uh, but if you were to post a logfile or whatever online you'd anyways sanitize it before posting, right?
I would, I know how to use sed
sed -i s/myactualusername/user/g log.txt
Don't use "user" as your username. Use a personalized one, because it is much easier to identify and obviously it is a requirement in a multi user context.
If you share your logs pseudonymize them, but pick anything other than "user", because it makes it confusing especially when dealing with pam, ssh etc.
Overall not great advise.
Why would I be worried about my username showing up in logs and errors?
Sometimes you may not want to be identified.
user is not in the sudoers file. This incident will be reported.