Dears
In our office, usage of 'where 1-1' using featureLayer.js in arcgis javascript api is blocked for owasp top 10 reasons.Please is there any reason to convince the admin that 'where 1=1' is not a hack attacked and is safe to use, or is there any alternative to using where 1=1 in arcgis javascript featureLayer.js api
https://developers.arcgis.com/javascript/latest/api-reference/esri-layers-FeatureLayer.html
Yes, I can successfully query with where clause such as
objectid >=0 shape is not null
but not
1=1
My organization use Web application firewall. They say usage '1=1' is not allow for OWASP Top 10 reason....
How can I proof that This usage is safe for ArcGIS server rest service?
Are you sure it's the 1=1 where clause that's the problem? Can you successfully query with any where clause?
objectid > 0 shape is not null
You might need to request that your organization create a firewall rule allowing traffic from your application server to the ArcGIS Server on ports 6080 and 6443.
Thanks for your reply.
I use 'all records' = 'all records' or 'true' = 'true'
The firewall still block it!
In case any esri employee sees this: are there actual reasons behind desicions such as having to use 1=1 or returning 200s for failed requests and then include error objects with status 500 in the response?This really isn't how rest should be done.
SQL does not have a true Boolean datatype so 1=1 is a way of evaluating to a constant true so all records are returned. You could use any SQL statement that evaluates to true.
2=2 'true'='true' 'all records'='all records'
サインインしたメンバーは投稿、更新のフォローなどができます。初めてですか？無料アカウントを登録してください。
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.
