lol fr. I always see stuff like this in products and think of how hard companies try to make so much of tech seem like it's magic, and not just some HTTP request, probably to a spring boot API...

news.ycombinator.com/item?id=4401...

IANA anything to do with this field, but there is some decent discussion on this study here.

That was a really fun read!

Heads up, I _think_ there are a couple typos in this line

> Just like that, we've seemingly replicated CVE-2025-4427 - but as always, we cant't help but wonder about t why this vulnerability works this way.

That one line issue with XXE, I seem to remember coming across something when I had the same issue where a Java version change causes newlines to throw an exception vs older java would just send them. I _think_ it was version 11, but google is not cooperating today.

jinja2.exceptions.UndefinedError: 'randstr' is undefined 👀 😅

Yep.

Then I accidentally click one of the columns like `host` and it changes without me realizing it, then I go insane thinking burp is broken 😅

I kinda wish you could lock that somehow...