be able to use type-I XSS (or CSRF) to convince a user to make a request with
MessageType containing ".." sequences. These in turn might be used with %0 (null
bytes) to access a web server log that contains XSS in it. In this case, there are
effectively three interaction points - lines 2 and 7, in addition to whatever attack