this kep

[Matheus Huffman  @matheushuffman]

@UnibotOnSolana
Testing out $unibot on sol. Loving the speed tbh.

[Matheus Huffman  @matheushuffman]

Sol XY just dropped, @solxy_game

🧵👇

[Matheus Huffman  @matheushuffman]

aped 1 sol on this new $MANGO ponzi on $SOL

[this kep @complite73]

@hecsembmim33101 😼

[Maximillion Leverage @MaximLeverage]

How you mfs be looking irl (based on 5 years of extensive research)

[Tib3rius @0xTib3rius]

This kinda blew up. 😅 The answer is no, there isn't anything insecure here (in terms of vulnerabilities). The code was purposefully written to look vulnerable to SQL injection, but Flask actually prevents any non-positive-integer values of "foo" from ever reaching the SQL.

Of course, you should still use prepared statements whenever you can, but in this case, it's not strictly necessary for secure code. 🤷‍♂️

I summarized my responses to some of the more popular (incorrect) answers below:

"It's Python"

Oh, stop it. 😛

"It's vulnerable to IDOR / User Enumeration"

This is partially my fault for using a "user" lookup as the example. It certainly *could* be vulnerable to IDOR / user enumeration, however one could also argue that's the entire point of the functionality itself, which takes an integer ID via the URL and returns true or false based on whether the user exists or not.

IDOR and Enumeration bugs in general are highly contextual. Case in point, with some minor changes, similar code could be used to tell a user whether a certain item was in stock at an ecommerce site. Is that an IDOR or an enumeration bug? Probably not.

"I can DoS the database by repeatedly sending requests"

Probably, though arguably every application is vulnerable to some form of denial of service if you generate enough requests.

"The database doesn't have any authentication"

It's SQLite.

"You're using SQLite"

Many small applications use SQLite. It's fine.

"Don't use SQLite in production"

WAT?

"Don't use Flask in production"

Who said my code is in production? Also, WAT?

"The code isn't using best practices"

Right...but it's still secure... *shocker*

"It's vulnerable when running on <insert 3+ year old version of Python and/or Flask here>"

Come on now. Let's be serious. The code was written in the present day, I didn't mention a specific version, assume it's the latest.

"<insert ChatGPT's wrong answer here>"

We're still safe from AI.

"What if someone calls the user(foo) function separately?"

Do they in the code I wrote? No. The question was "is there anything insecure about *this* code?", nothing more.

"What if Flask introduces a bug in the converter?"

This one I found hilariously short-sighted considering the rather obvious counter-example: What if sqlite3 introduces a bug in prepared statements?

"Lol, noob, you're returning booleans as strings."

If you knew what you were talking about, you'd understand that when you return from these functions, Flask creates an HTTP response using the return value. In this case, I simply wanted either the string True or False to be returned in the response, hence I used the strings "True" and "False". If you use actual booleans, Flask throws an exception.

[PaLM AI - $PALM @palmaierc]

Development Recap is now live on $PALM's Medium🌴

In this week's recap, we go over the developments we've worked on, while also shining a light on what's expected next week!

https://t.co/rUJSGJGu5b

What's the most exciting news in this recap?
Let us know 👇👀

[this kep @complite73]

@CookerFlips @blur_io i thougut you got hacked xD

[MOG COIN @mogcoin]

Who up thinking about mog rn 🤓🙋🏻‍♂️

[this kep @complite73]

#cryptonews new token coming

[this kep @complite73]

#cryptonews my theory is right.

[this kep @complite73]

#avax can i kick it?

[this kep @complite73]

#avax @luxnfts yo