Last year a user managed to inject arbitrary javascript into reddit's markdown syntax. Can someone explain how this was done and how I can test whether my site is similarly vulnerable?
+2
A:
Blog entry on the exploit:
http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html
The patch that fixed it:
http://code.reddit.com/changeset/1f1f0606f5b6bf14a0db55a28cfd03e1e42e3550
jedberg
2010-03-06 17:18:02