Will Ajax get another bad rap? Yahoo worm

Just like the Sammy worm attacked MySpace last October another JavaScript flaw in Yahoo email is using the good ole XHR object to grab a users address book and use another technique to send the list of emails to another remote server. Want to see the code look here and you will see the famous lines that look for 4 and 200 with the XHR object!

Now this is why I stress in every single one of my talks about making sure your code does not allow JavaScript injection if you are displaying user input! I even have had interviews (one example) where I stress that you need to do checks. If something this big can affect a company like yahoo, imagine what it can do to your site.

Eric Pascarello
Coauthor of Ajax In Action
Moderator of HTML/JavaScript at www.JavaRanch.com
Author of: JavaScript: Your Visual Blueprint for building Dynamic Web Pages