Good grief, let me vent for a bit here please.
We're 2 weeks from production release of the big flashy software I've built the front-end for and I've argued with the back-end guys because it's clear they never ever touched anything back-end related (and turned out true, by their very admission).
So, now we're bug fixing and refining stuff and a couple of things are totally sticking out like sore thumbs, but apparently no one except me gives a shit about them, when we totally have to change a couple of translation strings that don't break anything and can be easily changed in prod without having to rebuild the entire project.
1) Turns out back-end rarely sanitizes and escapes queries.
I've never even thought to test quotes in search fields because I thought they were using some prepared statement function that Hibernate totally has available, exactly like I would do with PHP/PDO without even thinking twice about it.
Apparently, they didn't prepare shit for LIKE comparisons, and now if our dear customers send a single quote, here's what they see:
Code:
java.lang.IllegalArgumentException: org.hibernate.QueryException: expecting ''', found '<EOF>' (select u from someTable u where lower(u.someField) like '%'%' order by someOtherField ASC)
I AM CRY, but especially for the back-end peeps, because they'll have to rewrite hundreds of queries just before the deadline.
2) Passwords. Oh, passwords.
Passwords are stored in plain text, always have been and always will be.
I pointed it out, like, the second they put the database online. No one cared.
We're gonna ship a product for a multinational with plain text passwords. Hurray!
3) The super user.
Now, this is linked to the previous point, but you know, it's also worse.
The software will have a super user with all permissions enabled, it can only be created and modified manually in the database, and it's obvious purpose is to fix eventual customer's screw-ups.
The super user is called "admin".
Its password is "admin".
Today I was reviewing the user manual the project manager's going to give to the customer, and when I read about the super user he told me, all proud of himself like it was the most important IT security breakthrough of this decade: "I didn't write the password in the manual, so we can give it only to important people and any other users won't ever know how to log in as the super user!"
I was, like: "yeah well, of course we're not giving away the key to the entire software to everybody, but I'm sure you're going to change the password before production, aren't you?".
He looked at me puzzled. "No, it's not gonna change. If I had to change it now, I would need to change all the DB population scripts and test them again. And what's the point? I'm not writing it in the user manual, they'll never know about it!"
Goddamit, why not going with "1234", then? At least it's different than the username...
4) The non relational DB.
We have this super-object that contains a tree of sub-objects, all hierarchically ordered and whatnot.
We built a table for the super-objects and a table for the sub-objects, and at that point... did we build a table to relate them in some kind of hierarchy?
Nope!
The great solution they came up with is to create an XML of the sub-objects tree and shoehorn it in a CLOB field of the super-object.
Cons:
- DB population scripts are an absurd chore when you have to populate thousands of super-objects containing XML trees of thousands of sub-objecs each;
- XML this long are inevitably prone to syntax errors, and they all show both in back- and front-end everytime the DB is burned down and rebuilt to insert a new super-object;
- the software is REST, so the back-end has to convert the XML to JSON before sending it to me, just for the fun of adding a completely avoidable layer of complexity to the system;
- of course for each of these sub-objects you also need to send a SELECT to their own table to get additional infos that cannot be put in the XML because they would exceed the CLOB size.
Pros: I honestly don't know, and the back-end guys don't know either.
5) They goodamn hardcoded the localization folder, and called it something like (the original is in Italian btw): "Test_Folder_Translations_for_the_Software". I'm sure the customers' IT guy will have more than a laugh, but I'm kinda dying of shame.