Context Is the New Security Vulnerability
For most of software history, we knew what untrusted input looked like. Request parameters, form submissions, and user uploads are untrusted. External data requires validation before we use it. Application security revolves around maintaining this separation. User input provides values to the application. It must not redefine what the application is allowed to do. SQL, command, and template injections are dangerous for this exact reason. They break the assumption of separation and allow data to influence execution....