Why are developers so vulnerable to drive-by attacks?

This post details a specific instance of a drive-by RCE attack against the GitLab Development Kit (GDK) by chaining vulnerabilities in Better Errors and webpack-dev-server. It explains how improper content type validation and lack of CSRF protection in Better Errors, combined with webpack-dev-server's permissive CORS configuration, allowed for arbitrary code execution. The post also provides a general explanation of drive-by attacks, CORS preflight requests, simple requests, and the importance of proper origin validation and CSRF protection.