What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

Try following:

  1. go to query http://odata.stackexchange.com/stackoverflow/q/734
  2. enter abc as UserId
  3. run query
  4. you'll get this error message: Error: Invalid column name 'abc'.

Error message should say something like "got a string for UserId when expecting a number" or "can't convert 'abc' to an integer".

share|improve this question

2 Answers 2

up vote 1 down vote accepted

The only way we can improve on this is to introduce strongly typed params, at the moment they are a directly injected with a text substitution.

If we knew they were supposed to be ints then we could do something nicer, but that would make the metadata format for params more verbose. Eg ##UserId##:int. I guess we could assume any param ending with Id should be a number.

share|improve this answer
    
There are only limited number of parameter types. You could try them all out with normal sql parameter binding. Jeff Atwood had a meta post ( meta.stackexchange.com/questions/51395/… ) about possible educational aspects of Data Explorer. I think that an example of sql injection should not be one of them ;) –  Juha Syrjälä May 28 '10 at 6:11
    
@Juha, we are allowing people to execute arbitrary SQL here, sql injection really is not a concern, inject away the connection to the db is running under a read-only user –  waffles May 31 '10 at 9:26

You get your expected error when you quote your text ('abc'):

Error: Conversion failed when converting the varchar value 'abc' to data type int.

The token is just replaced, so the query is

...
and owneruserid = abc
...

Since abc is not quoted, it is considered to be a column name.

share|improve this answer
    
So this has built-in sql injection vulnerability? But that doesn't probably matter, since you can directly do any queries you like. –  Juha Syrjälä May 27 '10 at 20:17
    
@Juha Syrjälä: Yes, sort of. You can execute this query for example: ##x## and enter Select * From posts as value for x. But as you say, you can edit the query anyway so this doesn't make a difference. –  Peter Lang May 27 '10 at 20:35
    
re vulnerability, try "drop table Posts​" or "delete from Posts" or "update Posts set Score = 0" –  waffles May 27 '10 at 21:45
    
    
@JonSeigel: Ah, thank you :) –  Peter Lang Jan 5 '11 at 8:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .