Hacker News new | ask | show | jobs
by swehner 4312 days ago
Line 53 of https://github.com/fastmonkeys/stellar/blob/master/stellar/o... is

                CREATE TABLE %s.%s LIKE %s.%s
This made me think of a table called

                create table `a; drop table users;`  (col int);
... which works in mysql.

I don't know if the stellar code will trip over something like this. But mysql (SQL) shouldn't even allow names like that.
1 comments
obsession 4312 days ago
Yes, Stellar will probably trip over this. Similarly, if the attacker can edit stellar.yaml, they probably can edit your .bashrc as well.

Im adding this to my TODO list.

link