Tan Shiaw Uen shiawuen

##How Homakov hacked GitHub and the line of code that could have prevented it

Please note: THIS ARTICLE IS NOT WRITTEN BY THE GITHUB TEAM or in any way associated with them. It's simply hosted as a Gist because the markdown formatting is excellent and far clearer than anything I could manage on my personal Tumblr.

@homakov’s explot on GitHub was simple and straightforward. Calling it an attack makes it sound malicious whereas the truth was that GitHub bolted its front door but left the hinges on quick release. Homakov released the hinges, walked in and shouted to anyone who would listen that they had a problem.

	var goose = require('mongoose')
	, db = goose.connect('mongodb://localhost/testmongo')
	, Schema = goose.Schema
	, sc = new Schema({
	a: String,
	b: Date
	})

	sc.methods.bbb = function() {
	return this.b.getFullYear()



	app.get('/path/to/html.html', function(req, res, next) {
	console.log('oh hai!');

	// The request will then pass down to the static file middleware
	next();
	});


	// ....

	app.configure(function() {
	// ....

	app.set('views', __dirname + '/public');
	app.set('view options', { layout: false });
	app.register('.html', {
	compile: function(str, options){

	var yourAsyncDynamicHelper = require('./yourAsyncDynamicHelper')

	app.configure(function(){
	//
	// other middlewares
	//

	app.use(yourAsyncDynamicHelper());

	//



	var Product = new Schema({
	quantity: { type: Number }
	, title: { type: String, trim: true }
	, category: { type: ObjectId, ref: 'Category' }
	})

	var Model = db.model('Product', Product);


	var userSchema = new Schema({
	email: String
	, passwordHash: String
	});

	userSchema.pre('validate', function(next) {
	if (this.password === this.passwordConfirm) {
	this.set('passwordHash', hash(this.password);

	<!DOCTYPE HTML>
	<html lang="en-US">
	<head>
	<meta charset="UTF-8">
	<title>Combination – stupid way</title>
	</head>
	<body>

	<script src="index.js"></script>
	</body>