User-Agent Header Ignored
A missed validation on the User-Agent header led to a JavaScript injection in the admin panel.
A junior sent me his work for code review and was very proud about the exhaustive validation he put on the user input. When I asked him why he didn't validate the User-Agent header, he argued that it is not entered by the user and it cannot contain special characters or HTML anyway. The best way to convince him was to inject a nice JavaScript alert in the admin panel through the User-Agent header.
Names and the company have been scrubbed. Stories are lightly edited for length and clarity, never for content. If something here is yours and you want it taken down, email me and it's gone.
Sign in to join in. Reading needs nothing.