JavaScriptã§ã‚»ã‚ュアãªã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’ã™ã‚‹ãŸã‚ã«æ°—ã‚’ã¤ã‘ã‚‹ã“ã¨kintoneã¯JavaScriptを使ã£ã¦è‡ªç”±ã«ã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºã§ãã¾ã™ã€‚ カスタマイズã«ã‚ˆã‚Šç‹¬è‡ªã®ãƒªãƒƒãƒãªUIを構築ã—ãŸã‚Šã€æ–°ã—ã„æ©Ÿèƒ½ã‚’è¿½åŠ ã—ãŸã‚Šã§ãã¾ã™ãŒã€ã‚»ã‚ュアãªã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’ã—ãªã„㨠クãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティング （以下ã€XSS）ãªã©ã®è„†å¼±æ€§ã‚’作り込んã§ã—ã¾ã†å±é™ºæ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã“ã®è¨˜äº‹ã§ã¯ã€JavaScriptã§ã‚»ã‚ュアãªã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’ã™ã‚‹ãŸã‚ã®åŸºæœ¬çš„ãªãƒã‚¤ãƒ³ãƒˆã‚’解説ã—ã¾ã™ã€‚
å˜ç´”ã§ã¯ãªã„ã€æœ€æ–°ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティングã€äº‹æƒ…
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚了日を2020å¹´1月31æ—¥(金)ã«æ±ºå®šã—ã¾ã—㟠- ã¯ã¦ãªã®å‘ŠçŸ¥
サーãƒã‚µã‚¤ãƒ‰ã‹ã‚‰ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ã®JavaScriptを呼ã³å‡ºã™éš›ã®ãƒ™ã‚¹ãƒˆãƒ—ラクティス - kazuhoã®ãƒ¡ãƒ¢ç½®ãå ´
iframeを使ã£ã¦ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§Cookieを書ã込む[iframe][sso] - Webã®ä¸–ç•Œã§è™¹ã‚’架ã‘ã‚‹![iframeを使ã£ã¦ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§Cookieを書ã込む[iframe][sso] - Webã®ä¸–ç•Œã§è™¹ã‚’架ã‘ã‚‹](https://cdn-ak-scissors.b.st-hatena.com/image/square/9f504a30d9652f45ceada6508593faedb5fb9da0/backend=imagemagick;height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2Ff9e984fdb11f5f2a2638622881ef1b9745a5dd3d%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fimages-fe.ssl-images-amazon.com%252Fimages%252FI%252F51wWshX%25252BoIL._SL160_.jpg)
æ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€JSONã«ã¯ X-Content-Type-Options: nosniff ã‚’ã¤ã‘ã‚‹ã¹ã - 葉ã£ã±æ—¥è¨˜
データをpostMessageã§å—ã‘渡ã™ã‚»ãƒƒã‚·ãƒ§ãƒ³é™ã‚Šã®ãƒˆãƒ¼ã‚¯ãƒ³å–å¾—(å–å¾—ã—ãªã„)フãƒãƒ¼
Same-Origin Policy ã¨ã¯ä½•ãªã®ã‹ã€‚ - 葉ã£ã±æ—¥è¨˜
ãªãœGoogleã¯JSONã®å…ˆé ã« while(1); ã‚’ã¤ã‘ã‚‹ã®ã‹ - Qiita
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚了日を2020å¹´1月31æ—¥(金)ã«æ±ºå®šã—ã¾ã—㟠- ã¯ã¦ãªã®å‘ŠçŸ¥
{{#tags}}- {{label}}
{{/tags}}