2 ms·
Email? As in like sending emails?
by euroclydon 14y ago
Email? As in like sending emails?
- tptacek 14y agoWe take very hard looks at both inbound and outbound email functionality. Bunch of reasons: 1. Breaks out of the web security domain, requiring devs to think through and implement controls that compensate for things like sessions and access control. 2. New quoting domain creates opportunities for injection to leverage apps to send unexpected messages. 3. Often involves shelling out, with all the attendant risks of that. 4. Inbound mail has different input restrictions than web apps do, creating opportunities for submarined XSS or even SQLI. It's just a really common place where apps suddenly sprout unexpected moving parts, is what it boils down to.