diff options
| author | 284km <k.furuhashi10@gmail.com> | 2018-04-12 13:07:53 +0900 |
|---|---|---|
| committer | 284km <k.furuhashi10@gmail.com> | 2018-04-12 13:14:06 +0900 |
| commit | 1502c60ec270cb6b92af151637fc8b47f42b2816 (patch) | |
| tree | c6442e6ab330103fffb886882f70039e5f9f0a8c /guides/source/security.md | |
| parent | 7622b85a300a1863ece44eb429ddabdadbee7f77 (diff) | |
| download | rails-1502c60ec270cb6b92af151637fc8b47f42b2816.tar.gz rails-1502c60ec270cb6b92af151637fc8b47f42b2816.tar.bz2 rails-1502c60ec270cb6b92af151637fc8b47f42b2816.zip | |
Fix MySpace Samy worm link [ci skip]
The old link https://samy.pl/popular/tech.html is 404 not found.
Diffstat (limited to 'guides/source/security.md')
| -rw-r--r-- | guides/source/security.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.md b/guides/source/security.md index ffd7e66fc5..06c24670de 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -862,7 +862,7 @@ In December 2006, 34,000 actual user names and passwords were stolen in a [MySpa INFO: _CSS Injection is actually JavaScript injection, because some browsers (IE, some versions of Safari and others) allow JavaScript in CSS. Think twice about allowing custom CSS in your web application._ -CSS Injection is explained best by the well-known [MySpace Samy worm](https://samy.pl/popular/tech.html). This worm automatically sent a friend request to Samy (the attacker) simply by visiting his profile. Within several hours he had over 1 million friend requests, which created so much traffic that MySpace went offline. The following is a technical explanation of that worm. +CSS Injection is explained best by the well-known [MySpace Samy worm](https://samy.pl/myspace/tech.html). This worm automatically sent a friend request to Samy (the attacker) simply by visiting his profile. Within several hours he had over 1 million friend requests, which created so much traffic that MySpace went offline. The following is a technical explanation of that worm. MySpace blocked many tags, but allowed CSS. So the worm's author put JavaScript into CSS like this: |