I will address a point that has not really been raised before about clause 11 and names containing computer code. [..] My understanding is that the clause is to guard against SQL injection into the Companies House register, because anyone pulling that out of the register can have their systems corrupted by companies that register with computer code.
[..] A company has been registered [..] under the name ; DROP TABLE "COMPANIES";-- LTD, which has some computer code around it.
As the post above points out, this would either work fine or cause an error, because of the quotes -- it's not actually SQL injection.
In theory, a system could have an actual vulnerability but if it does it would mean it's also going to fail on any name with a single or double quote in it (depending on the SQL dialect). Not sure why anyone would legislate a workaround to what is essentially a "intro to databases" level programming bug.
I suspect the actual reason for it coming up in law was because of the XSS company somebody registered some time after my meme went around. That one actually did work*, and as I understand it, there was no recourse available to companies house - they are legally obliged to accurately record company names, and the law specifies which characters can be in company names, meaning you could always serve XSS there, which they're not a fan of.
That said, they forced my company name to show as 'name available on request' now (even on letters they send me, which is kind of funny), so apparently they did find a workaround.
Comments
This is the company in question:
https://find-and-update.company-information.service.gov.uk/c...
And a post from the person who registered it
https://pizzey.me/posts/no-i-didnt-try-to-break-companies-ho...
As the post above points out, this would either work fine or cause an error, because of the quotes -- it's not actually SQL injection.
In theory, a system could have an actual vulnerability but if it does it would mean it's also going to fail on any name with a single or double quote in it (depending on the SQL dialect). Not sure why anyone would legislate a workaround to what is essentially a "intro to databases" level programming bug.
(Person who registered the company above here)
I suspect the actual reason for it coming up in law was because of the XSS company somebody registered some time after my meme went around. That one actually did work*, and as I understand it, there was no recourse available to companies house - they are legally obliged to accurately record company names, and the law specifies which characters can be in company names, meaning you could always serve XSS there, which they're not a fan of.
That said, they forced my company name to show as 'name available on request' now (even on letters they send me, which is kind of funny), so apparently they did find a workaround.
* On third party systems consuming the data*