And here I thought java was secure

Interesting article on hacking jroller. I certainly wouldn't have known that FileOutputStream treats strings as null terminated.