XAS: Cross-API scripting attacks in social ecosystems