diff options
| author | प्रथमेश Sonpatki <csonpatki@gmail.com> | 2017-05-21 19:49:40 +0530 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-05-21 19:49:40 +0530 |
| commit | 3cb4d8357d464347757bb5d346e1c88403d3e0ce (patch) | |
| tree | d13d0394288b26086ed4f8ad87bb6ee864608d23 /guides/source | |
| parent | 7a2041335f2a5f86179e303fa84a4653f58e1620 (diff) | |
| parent | d23fb68e3d4b8cc81e877266aefce95dac562699 (diff) | |
| download | rails-3cb4d8357d464347757bb5d346e1c88403d3e0ce.tar.gz rails-3cb4d8357d464347757bb5d346e1c88403d3e0ce.tar.bz2 rails-3cb4d8357d464347757bb5d346e1c88403d3e0ce.zip | |
Merge pull request #29168 from ffmike/fix-broken-links-guides
Fix broken external link in security guide.
Diffstat (limited to 'guides/source')
| -rw-r--r-- | guides/source/security.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.md b/guides/source/security.md index c305350243..1fcb2fc91f 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -796,7 +796,7 @@ In December 2006, 34,000 actual user names and passwords were stolen in a [MySpa INFO: _CSS Injection is actually JavaScript injection, because some browsers (IE, some versions of Safari and others) allow JavaScript in CSS. Think twice about allowing custom CSS in your web application._ -CSS Injection is explained best by the well-known [MySpace Samy worm](http://namb.la/popular/tech.html). This worm automatically sent a friend request to Samy (the attacker) simply by visiting his profile. Within several hours he had over 1 million friend requests, which created so much traffic that MySpace went offline. The following is a technical explanation of that worm. +CSS Injection is explained best by the well-known [MySpace Samy worm](https://samy.pl/popular/tech.html). This worm automatically sent a friend request to Samy (the attacker) simply by visiting his profile. Within several hours he had over 1 million friend requests, which created so much traffic that MySpace went offline. The following is a technical explanation of that worm. MySpace blocked many tags, but allowed CSS. So the worm's author put JavaScript into CSS like this: |