Web Vulnerabilities (the OWASP classics)

The handful of places a website reads a stranger’s typed words, and what goes wrong the moment it can’t tell those words apart from an order.

Before you start. The last lesson showed a trusted helper doing something for the wrong person because it never checked who really asked - Authorization & Identity‘s confused deputy. This lesson is a different failure at the same kind of boundary: a computer reading a stranger’s words as an instruction instead of as a name, a comment, or an address.

On 4 October 2005 a nineteen-year-old named Samy Kamkar added a few lines of text to his MySpace profile. Anyone who viewed his page had those same lines quietly copied onto their own profile too, and a friend request to Samy went out with no click from them at all. Each visitor’s browser copied it onward, so the count doubled instead of adding one at a time: within twenty hours, over a million profiles carried it, and MySpace pulled the site offline to stop it. Samy hadn’t broken into anything. He had found a box on the page - the “about me” text - that MySpace’s own code read back out loud to every visitor’s browser, and a browser told to run something, runs it.