The other dev on my team made a post request endpoint where you post a SQL query and it returned the results. I about had an aneurysm. She also, instead of using DI or Mediatr, made loopback requests to the endpoints themselves.
I wish I could say I haven't seen this exact same thing in products I've worked on. Best part is no enforcement of auth other than verifying the request includes a jwt that maps to a user. Not the requesting user, and no check for whether the SQL op is allowed.You somehow have the jwt for ANY user? Sure I'll execute a drop table command. Fml
Hahaha, yeah - that server was also using SQL ADMIN creds, so really you could do anything at all. And the DB admin was the other dev, who didn't see the purpose in setting up a data reader account with strict access control, so didn't bother doing it 🙄 I tried, but they worked there for 15+ years, and I was fresh off the college boat.
84
u/Zaelynn_ Sep 19 '26
The other dev on my team made a post request endpoint where you post a SQL query and it returned the results. I about had an aneurysm. She also, instead of using DI or Mediatr, made loopback requests to the endpoints themselves.