Hacker News Reader

Hacker News

Comment by dangrossman | Hacker News Reader

Parent Full thread

dangrossman

I can see having this pass by a reviewer or two. They look and see all of this:

- There are permission checks

- The user has to be logged in to GWT

- The user has to have access to this page

- The user has to be the owner of the siteUrl

After all those permission checks, it might appear that everything was covered. It's just one little omission, verifying that the urlt parameter corresponds to a page within the siteUrl website, that was missed.

View on HN

This is a pretty amateurish mistake, actually, and I'm shocked that it was in production at Google. Proper authorization checks are web programming 101.

If you make a checklist of security practices the QA testers should look for, they'd see and check off "proper authorization checks", as they were done on other fields of the same page. If you can't imagine a professional making this mistake, your mental image of an engineer is not realistic. Humans are not that perfect, and this mistake does not make everyone that reviewed this code an amateur.

Well, people are down voting me, but everyone ripped the developers of Diaspora apart for basically the same exact flaw in an early alpha release of their system. The Google fanboyism seems to be running strong here.

Those flaws were all over their entire codebase in very basic parts of the site's functionality. They had literally zero authorization checks.

eh? I don't see that as one little omission. It's kind of straightforward that you would need to be the owner of the actual URL to be deleted, so checking the siteUrl is not sufficient. I can understand if they only intended to allow relative paths from the siteUrl, and if there was some kind of bug in special characters or parameter parsing. But no, this is as bad as that bug in Citibank's site where you could just change the account number in the address bar [1]. Color me disillusioned with Google's security practices.

[1] http://consumerist.com/2011/06/how-hackers-stole-200000-citi...

Reply on news.ycombinator.com