**TL;DR:** In 2019, a security researcher found a vulnerability in a NASA system caused by improper input sanitization in a Java application. Interestingly, the architectural "guardrails" in OutSystems are designed to prevent this exact type of flaw (Expression Injection) out of the box.

# What was the NASA vulnerability?

The flaw was an **Expression Injection** vulnerability. An attacker could provide a specific string of code as an input (via a URL or form field), and the server-side engine would execute that string. This allowed for unauthorized data access and server manipulation.

# How OutSystems prevents this by design:

OutSystems utilizes a "Security by Default" approach that mitigates these risks through several layers:

* **Automatic Input Encoding:** OutSystems automatically encodes data rendered in expressions. If a user inputs `<script>`, it is treated as literal text, not executable code.
* **Strong Typing:** Unlike many high-level languages where "everything is a string," OutSystems' strong typing prevents many forms of injection at the compilation level.
* **Sanitized Built-in Functions:** Built-in functions like `EncodeHTML()` and `EncodeJavaScript()` are standardized, reducing the likelihood of a developer "forgetting" to sanitize a specific input.

# Why "Pro-Code" logic still matters in Low-Code:

While the platform provides the shield, developers can still create holes if they:

1. Use the **"Escape Content = No"** property on Expressions (this should be used with extreme caution).
2. Execute raw SQL strings without using **SQL Parameters**.
3. Manually integrate vulnerable third-party JavaScript libraries.

# The Lesson:

Low-code platforms like OutSystems significantly reduce the "surface area" for common attacks like those seen at NASA, but they don't replace the need for a security-first mindset during the development lifecycle.

[2024-05-19] - OutSystems Security: How the NASA "Expression Injection" vulnerability is prevented by default in Low-Code