• 3 Posts
  • 90 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle








  • I had this happen to me. The program was only used internally but it was possibly the worst code that would compile. My personal favorite was the “login”. When launching the program it accessed a local sql server. On that server was a table named “login” which you would assume had a list of all users and their passwords right?

    Now that would be bad because you could launch ssms directly and just look at the table but when you did that there was 1 entry user “admin” password “admin”.

    But that’s not all… When you look at the code these values are hard coded in. There is a linq query to check the login table for an entry with username “admin” and password “admin” and return the values in password. Now you might be thinking what the hell but here’s the kicker…when it got the response back it checked len(password) => 5

    Yup… Didn’t check if password was correct just that the length of the password was equal to or greater than 5.

    The actual username entry box? Yeah it didn’t validate anything. You could just bang your hand on the keyboard and log in… Really you didn’t even have to do that. You had to click or tab into the field and then click login. It didn’t require you to enter anything just that the username field was active at some point.












  • Depends on the field you’re in. At my previous company to release a new system for internal use only I had to go through 19 validations(each one 50-100 pages of manual tests). None of it had real source control except uploading final zip of files(no source code, just the enable files).

    I wrote all the files, wrote all the test cases, wrote all the documentation, executed everything and wrote most of the reports. They just fired me last week so hope they have fun when they need to update something…