TangentFoxy
commented
8 years ago Why not have two instances of Lapis running that interact with each other? One with permissions for the safe data, one with permissions for the vulnerable data?
(I don't know if my idea would be more difficult, or if I have misunderstood, so sorry about that if it is so.)
Hey all, I'm writing a 'hacking challenge' webapp, i.e. a site which is intentionally vulnerable to some attack.
This webapp has two databases: the first one is privileged, where I store info about the participants and log their actions, in order to monitor what's happening, and the second one contains mock data for the app.
One of the vulnerabilities I've left open is an SQL injection attack. Because of this, users would be able to run arbitrary queries on the database server, so I need to sandbox that and make it safe. For this, I will be creating a dummy user with only SELECT privileges on the second database, and I want lapis to connect only using this user and this database on pages that are meant to have an SQL injection vulnerability.
The config system allows for global MySQL/PostgreSQL credentials, but I am wondering if there is a way to change the credentials according to the route matched.
If there is no such way as of now, I will be happy to implement it and submit a pull request, if you all agree.