Injections in Stripe Search Queries and How to Prevent Them

• stripe-escape-input

  1 0 4.8 JavaScript

  Prevent injections in Stripe search queries by escaping user input

• Stripe

  300 3,601 8.9 PHP

  PHP library for the Stripe API.

  

I was developing a backend that integrates Stripe to manage customers and to process subscriptions. In one use case, it should search for user input in the metadata of Stripe subscriptions. When I looked up the documentation about how to use the search functionality I came across the Search Query Language. It looked like users could easily inject their own additional query clauses. After a simple check: Yes, e.g. for the user input "124' OR status:'active" all active subscriptions are returned as well.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project