Security Engineering · Cluster
Web Application Security
Injection, XSS, and request forgery.
- 01 SQL Injection as a Failure of the Tokenization Boundary Why a database cannot distinguish a value from a statement once they are concatenated into one string, and how separate parameter transport restores the boundary.
- 02 HTML Parsing Contexts and Why One Escape Function Is Never Enough How the HTML tokenizer switches states by context, what each state treats as dangerous, and why encoding rules must be chosen per insertion point rather than per application.
- 03 How a Browser Computes an Origin, and Why Ports and Schemes Count The tuple comparison behind the same-origin policy, the opaque origins that never match anything, and the document.domain exceptions that weaken the rule.
- 04 Cross-Site Request Forgery and the Problem of Ambient Authority Why a browser attaches cookies to requests it did not intend to make, which request shapes are reachable without a script, and how token binding restores an intent check.
- 05 Header Splitting: When a Value Becomes a Field Boundary How CR and LF terminate header fields on the wire, what modern servers do to reject them, and why the response body and the request line need separate treatment.
- 06 DOM XSS: Sources, Sinks, and Why the Server Never Sees the Payload How client-side flow from attacker-controlled input to an executing sink bypasses server-side encoding, and which of the flow-tracking approaches can follow the value.
- 07 CSP Nonces and the Script Gadgets That Survive Them How a nonce marks the scripts a policy permits, why whitelisting a host also authorises every script on it, and how existing library code becomes an execution path.
- 08 Server-Side Request Forgery and the Address the Server Can Reach Why filtering a user-supplied URL is a parsing problem with a resolution step attached, and where DNS, redirects, and IPv6 forms defeat the check.
- 09 Server-Side Template Injection: When Data Reaches an Evaluator Why template engines are interpreters, how a template chosen from user input escalates from text output to code execution, and why sandboxes are the wrong layer.
- 10 The Places Parameter Binding Cannot Reach Identifiers, sort direction, operators, and collation are resolved before execution, so binding cannot protect them; the designs that survive are structural.