[B! javascript][security] yachimonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

yachimon id:yachimon

javascriptã¨securityã«é–¢ã™ã‚‹yachimonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (16)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã€Œãƒ«ãƒ¼ãƒ—URLè²¼ã£ã¦è£œå°Žã€ã€ŒCoinhiveé€®æ•ã€ã«ã€â€œJavaScriptã®çˆ¶â€ãƒ–ãƒ¬ãƒ³ãƒ€ãƒ³ãƒ»ã‚¢ã‚¤ã‚¯æ°ã‚‚è‹¦è¨€
ã€Œãƒ«ãƒ¼ãƒ—URLè²¼ã£ã¦è£œå°Žã€ã€ŒCoinhiveé€®æ•ã€ã«ã€â€œJavaScriptã®çˆ¶â€ãƒ–ãƒ¬ãƒ³ãƒ€ãƒ³ãƒ»ã‚¢ã‚¤ã‚¯æ°ã‚‚è‹¦è¨€ JavaScriptã®ãƒ«ãƒ¼ãƒ—æ©Ÿèƒ½ã‚’ä½¿ã£ã¦ãƒãƒƒãƒ—ã‚¢ãƒƒãƒ—ãŒç¹°ã‚Šè¿”ã—è¡¨ç¤ºã•ã‚Œã‚‹ã‚µã‚¤ãƒˆã®URLã‚’æŽ²ç¤ºæ¿ã«æ›¸ãè¾¼ã‚“ã ã¨ã—ã¦ã€ä¸æ£æŒ‡ä»¤é›»ç£çš„è¨˜éŒ²ï¼ˆã‚¦ã‚¤ãƒ«ã‚¹ï¼‰ä¾›ç”¨æœªé‚ã®ç–‘ã„ã§ä¸å¦ç”ŸãŒè£œå°Žã•ã‚Œã€ç”·æ€§2äººãŒå®¶å®…æœç´¢ã‚’å—ã‘ãŸäº‹ä»¶ãŒãƒãƒƒãƒˆã§æ³¢ç´‹ã‚’å‘¼ã‚“ã§ã„ã‚‹ã€‚ã€Œã“ã‚Œã ã‘ã§è£œå°Žã‚„å®¶å®…æœç´¢ã¯ã‚„ã‚ŠéŽãŽã ã€ã¨è¦å¯Ÿã‚’æ‰¹åˆ¤ã™ã‚‹å£°ã‚‚å¼·ã„ã€‚ ä¼¼ãŸäº‹ä»¶ã¨ã—ã¦æ˜¨å¹´ã€JavaScriptã®ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ä½¿ã„ã€ã‚µã‚¤ãƒˆé–²è¦§è€…ã«ä»®æƒ³é€šè²¨ã‚’ãƒžã‚¤ãƒ‹ãƒ³ã‚°ã•ã›ã‚‹ã“ã¨ã§åŽç›Šã‚’å¾—ã‚‹ãƒ„ãƒ¼ãƒ«ã€ŒCoinhiveã€ã‚’è¨ç½®ã—ãŸè¤‡æ•°ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒã€ä¸æ£æŒ‡ä»¤é›»ç£çš„è¨˜éŒ²å–å¾—ãƒ»ä¿ç®¡ãªã©ã®å®¹ç–‘ã§è¦å¯Ÿã«æ‘˜ç™ºã•ã‚ŒãŸã€‚ã“ã®æ™‚ã‚‚ã€Webé–‹ç™ºè€…ã®é–“ã§ã¯ã€Œé€®æ•ã¯ã‚„ã‚ŠéŽãŽã€ã€Œã©ã“ã¾ã§ãŒã‚»ãƒ¼ãƒ•ã§ã©ã“ã‹ã‚‰ãŒã‚¢ã‚¦ãƒˆã‹åˆ†ã‹ã‚‰ãªã„ã€ã¨å›°æƒ‘ãŒåºƒãŒã£ãŸã€‚ ã“ã‚Œã‚‰ã®äº‹ä»¶ã«ã¤ã„ã¦ã€JavaScrip
yachimon 2019/03/08
javascript

law

security

è¦å¯Ÿ
ãƒªãƒ³ã‚¯
ãƒªãƒ³ã‚¯ã‚’ä½œã‚‹æ™‚ã® target="_blank" ã®å±é™ºæ€§ - éš™ã‚ã‚‰ã°å¯ã‚‹
html ã§ ãƒªãƒ³ã‚¯ã‚’æ–°ã—ã„ã‚¿ãƒ–(ã‚„ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦)ã§é–‹ã‹ã›ãŸã„å ´åˆã€target="_blank" ã‚’æŒ‡å®šã™ã‚‹ãŒã€ ã“ã®ä½¿ã„æ–¹ã«ã¯è½ã¨ã—ç©´ãŒã‚ã‚‹ã‚‰ã—ã„ã€‚ www.jitbit.com ãƒªãƒ³ã‚¯ã‚’é–‹ã„ãŸå…ˆã® javascript ã‹ã‚‰ã€é–‹ã„ãŸå…ƒã®ãƒšãƒ¼ã‚¸ã‚’æ“ä½œã§ãã¦ã—ã¾ã†ã¨ã®ã“ã¨ã€‚ æ°—ã«ãªã£ãŸã®ã§ç¢ºèªã—ã¦ã¿ãŸã€‚ æ‚ªç”¨ã®ãƒ‘ã‚¿ãƒ¼ãƒ³ insecure.html ãŒæœ€åˆã«é–‹ããƒšãƒ¼ã‚¸ã§ã€ã“ã“ã« target="_blank" ãªãƒªãƒ³ã‚¯ãŒã‚ã‚‹ã€‚ ã“ã®ãƒªãƒ³ã‚¯ã‚’æŠ¼ã™ã¨ new_window.html ã‚’æ–°ã—ã„ã‚¿ãƒ–ã§é–‹ãã€‚ ã“ã® new_window.html ã« javascript ãŒä»•è¾¼ã¾ã‚Œã¦ãŠã‚Šã€å…ƒãƒšãƒ¼ã‚¸ã‚’æ“ä½œã•ã‚Œã‚‹ã¨ã„ã†è©±ã€‚ å…·ä½“çš„ã«ã¯ window.opener.location="./evil.html" ã¨å®Ÿè¡Œã™ã‚‹ã¨ã€å…ƒã‚¿ãƒ–ã¯ evil.html ã«é·ç§»ã™ã‚‹ã€‚ å®Ÿéš›è©¦ã—ã¦ã¿ãŸã®ãŒ ã“ã“ã€‚ ãƒªãƒ³ã‚¯ã‚’é–‹
yachimon 2019/02/04
javascript

security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
JavaScriptå®Ÿè¡Œæ™‚ã€ã€Œé–²è¦§è€…ã®äº†è§£ã‚’ã„ã¡ã„ã¡å¾—ã‚‹ã€ãƒšãƒ¼ã‚¸ç™»å ´ã€€ã€ŒCoinhiveã‚ˆã‚Šå«Œã€ã€Œæ‚ªå¤¢ã€ã¨è©±é¡Œ
JavaScriptå®Ÿè¡Œæ™‚ã€ã€Œé–²è¦§è€…ã®äº†è§£ã‚’ã„ã¡ã„ã¡å¾—ã‚‹ã€ãƒšãƒ¼ã‚¸ç™»å ´ã€€ã€ŒCoinhiveã‚ˆã‚Šå«Œã€ã€Œæ‚ªå¤¢ã€ã¨è©±é¡Œ ã‚µã‚¤ãƒˆé–²è¦§è€…ã«ä»®æƒ³é€šè²¨ã‚’ãƒžã‚¤ãƒ‹ãƒ³ã‚°ã—ã¦ã‚‚ã‚‰ã†ã“ã¨ã§åŽç›Šã‚’å¾—ã‚‰ã‚Œã‚‹ãƒ„ãƒ¼ãƒ«ã€ŒCoinhiveã€ã‚’ã€æ˜Žç¤ºã™ã‚‹ã“ã¨ãªãã‚µã‚¤ãƒˆã«è¨ç½®ã—ãŸè¤‡æ•°ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒã€ä¸æ£æŒ‡ä»¤é›»ç£çš„è¨˜éŒ²ï¼ˆã‚¦ã‚¤ãƒ«ã‚¹ï¼‰å–å¾—ãƒ»ä¿ç®¡ãªã©ã®å®¹ç–‘ã§è¦å¯Ÿã«æ‘˜ç™ºã•ã‚Œã€ç‰©è°ã‚’ã‹ã‚‚ã—ã¦ã„ã‚‹ã€‚ Coinhiveã¯ã€ã‚µã‚¤ãƒˆã«å°‚ç”¨ã®JavaScriptã‚³ãƒ¼ãƒ‰ã‚’åŸ‹ã‚è¾¼ã‚€ã¨ã€é–²è¦§è€…ã®CPUãƒ‘ãƒ¯ãƒ¼ã‚’ä½¿ã£ã¦ä»®æƒ³é€šè²¨ã‚’æŽ¡æŽ˜ã™ã‚‹ã€‚ä»Šå›žæ‘˜ç™ºã•ã‚ŒãŸ1äººãƒ»ãƒ‡ã‚¶ã‚¤ãƒŠãƒ¼ã®ã€Œãƒ¢ãƒã€ï¼ˆ@moro_isï¼‰ã•ã‚“ã¯è¦å¯Ÿã«ã€ã€Œäº‹å‰ã«è¨±å¯ï¼ˆã‚‚ã—ãã¯äºˆæ„Ÿã•ã›ã‚‹ã“ã¨ï¼‰ãªãä»–äººã®PCã‚’å‹•ä½œã•ã›ãŸã‚‰ã‚¢ã‚¦ãƒˆã€ã§ã‚ã‚Šã€æ˜Žç¤ºãªãCoinhiveã‚’è¨ç½®ã™ã‚Œã°é•æ³•ã¨ã®èª¬æ˜Žã‚’å—ã‘ãŸã¨ã„ã†ã€‚ ã ãŒCoinhiveã«é™ã‚‰ãšã€ç¾ä»£çš„ãªWebã‚µã‚¤ãƒˆã«ã¯ã»ã¼ã™ã¹ã¦ã€ä½•ã‚‰ã‹ã®JavaScriptãŒä½¿ã‚ã‚Œã¦ã„ã‚‹ã€‚
yachimon 2018/06/20
IE ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é«˜ã‚ã«ã™ã‚‹ã¨ã“ã‚“ãªæ„Ÿã˜ãªã£ãŸè¨˜æ†¶ã€‚ã¾ã¨ã‚‚ã«é–²è¦§ã§ããªã„ã‚“ã ã‚ˆãªã‚ã€‚

javascript

security

privacy

html

Coinhive

law
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã«ãƒã‚°ã‚¤ãƒ³ã—ã¦ã‚‹ã¨äººã®ãƒ–ãƒã‚°ã‚’è¦‹ãŸã ã‘ã§ãƒ¦ãƒ¼ã‚¶ãƒ¼åãŒãƒãƒ¬ã‚‹ - ç´ äººãŒãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚’å‹‰å¼·ã—ã¦ã„ãŸãƒ–ãƒã‚°
11 August 2014: ã¯ã¦ãªã®ã‚µãƒãƒ¼ãƒˆã‹ã‚‰é€£çµ¡ãŒããŸã€‚ ã„ã¤ã‚‚ã¯ã¦ãªã‚’ã”åˆ©ç”¨ã„ãŸã ãã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ ã”æŒ‡æ‘˜ã„ãŸã ãã¾ã—ãŸä»¶ã«ã¤ãã¾ã—ã¦ã€ãŸã ã„ã¾å¯¾å¿œã‚’æ¤œè¨Žã—ã¦ãŠã‚Šã¾ã™ã€‚ ç¬¬ä¸‰è€…ã«æ‚ªç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ã‚‚ã”ã–ã„ã¾ã™ã®ã§ã€ ã‚‚ã—ã€è„†å¼±æ€§ã‚’ç¢ºèªã•ã‚ŒãŸå ´åˆã«ã¯ã€å…ˆã«å¼Šç¤¾ã«ã”é€£çµ¡ã„ãŸã ãã€ è„†å¼±æ€§ãŒä¿®æ£ã•ã‚Œã‚‹ã¾ã§ã€ãƒ–ãƒã‚°ãªã©ã§è©³ç´°ã‚’å…¬é–‹ã•ã‚Œãªã„ã‚ˆã†ã”å”åŠ›ã„ãŸã ã‘ã¾ã™ã¨å¹¸ã„ã§ã™ã€‚ ã‚‚ã—ãªã«ã‹ã”ä¸æ˜Žãªç‚¹ãªã©ã”ã–ã„ã¾ã—ãŸã‚‰ã”é€£çµ¡ãã ã•ã„ã€‚ ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ ã—ã‹ã—ã‚µãƒãƒ¼ãƒˆã«ã¯ã“ã®è¨˜äº‹ã®URLã—ã‹é€ã£ã¦ã„ãªã„ã—ã€æ—¢ã«ï¼ˆä¸€éƒ¨ãƒ¦ãƒ¼ã‚¶ã«ã‚ˆã‚‹DDoSã‚‚å«ã‚ã¦ï¼‰89656ã®ã‚¹ã‚¿ãƒ¼ãŒã¤ãã»ã©é–²è¦§ã•ã‚Œã¦ã„ã‚‹ã®ã§ã€ã“ã®è¨˜äº‹ã‚’æ¶ˆã—ã¦ã‚‚ã—ã‚‡ã†ãŒãªã„ã€‚ã‚ˆã£ã¦ã€ã“ã®ã¾ã¾æ”¾ç½®ã™ã‚‹ã€‚èªè€…ã¯ä¿®æ£ã•ã‚Œã‚‹ã¾ã§ã€æ±ºã—ã¦æ‚ªç”¨ã—ãªã„ã§ã»ã—ã„ã€‚ ãƒ†ã‚¹ãƒˆ RSSã§è¦‹ã¦ã‚‹äººã¯ç›´æŽ¥é–‹ã„ã¦ãã ã•ã„ ã¯ã¦ãƒ–ã§æŒ‡æ‘˜ãŒã‚ã£ãŸãŒã€ã“ã®ãƒš
yachimon 2014/08/11
security

CSRF

ã¯ã¦ãªã‚¹ã‚¿ãƒ¼

javascript
ãƒªãƒ³ã‚¯
XMLHttpRequestã‚’ä½¿ã£ãŸCSRFå¯¾ç– - è‘‰ã£ã±æ—¥è¨˜
åˆã‚ã›ã¦èªã‚“ã§ãã ã•ã„ï¼šFlashã¨ç‰¹å®šãƒ–ãƒ©ã‚¦ã‚¶ã®çµ„ã¿åˆã‚ã›ã§cross originã§ã‚«ã‚¹ã‚¿ãƒ ãƒ˜ãƒƒãƒ€ä»˜ä¸ŽãŒå‡ºæ¥ã¦ã—ã¾ã†å•é¡ŒãŒæœªã ã«ç›´ã£ã¦ã„ãªã„è©± (2014-02/07) XMLHttpRequestã‚’ä½¿ã†ã“ã¨ã§ã€Cookieã‚„ãƒªãƒ•ã‚¡ãƒ©ã€hiddenå†…ã®ãƒˆãƒ¼ã‚¯ãƒ³ã‚’ä½¿ç”¨ã›ãšã«ã‚·ãƒ³ãƒ—ãƒ«ã«CSRFå¯¾ç–ãŒè¡Œãˆã‚‹ã€‚POSTã™ã‚‹JavaScriptã¯ä»¥ä¸‹ã®é€šã‚Šã€‚(2013/03/04:ã‚³ãƒ¼ãƒ‰ä¸€éƒ¨ä¿®æ£) function post(){ var s = "mail=" + encodeURIComponent( document.getElementById("mail").value ) + "&msg=" + encodeURIComponent( document.getElementById("msg").value ); var xhr = new XMLHttpRequest(); xhr
yachimon 2013/03/02
javascript

CSRF

security
ãƒªãƒ³ã‚¯
ï¼»æ°—ã«ãªã‚‹ï¼½JSONPã®å®ˆã‚Šæ–¹
XSSã«CSRFã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«â€¦â€¦Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãƒ—ãƒã‚°ãƒ©ãƒžãŒçŸ¥ã£ã¦ãŠãã¹ãè„†å¼±æ€§ã¯ã„ã£ã±ã„ã‚ã‚Šã¾ã™ã€‚ãã“ã§æœ¬é€£è¼‰ã§ã¯ã€ãã®ã‚ˆã†ãªãƒ¡ã‚¸ãƒ£ãƒ¼ãªã‚‚ã®â€œä»¥å¤–â€ã‚‚æŽ˜ã‚Šä¸‹ã’ã¦ã„ãã¾ã™ ï¼ˆç·¨é›†éƒ¨ï¼‰ JSONPã ã£ã¦ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’æ°—ã«ã—ã¦ã»ã—ã„ çš†ã•ã‚“ã“ã‚“ã«ã¡ã¯ã€ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ã§ã™ã€‚ä»Šå›žã¯ã€JSONPã‚’ä½¿ç”¨ã™ã‚‹å ´åˆã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦è§£èª¬ã—ã¾ã—ã‚‡ã†ã€‚ JSONPã¨ã¯ã€JSON with Paddingã®åç§°ãŒç¤ºã—ã¦ã„ã‚‹ã¨ãŠã‚Šã€JSONå½¢å¼ã®ãƒ‡ãƒ¼ã‚¿ã«ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã®å‘¼ã³å‡ºã—ã®ãŸã‚ã®ã‚³ãƒ¼ãƒ‰ã‚’ä»˜åŠ ã™ã‚‹ã“ã¨ã§ã€ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§ãƒ‡ãƒ¼ã‚¿ã®å—ã‘æ¸¡ã—ã‚’å®Ÿç¾ã™ã‚‹ãŸã‚ã®ãƒ‡ãƒ¼ã‚¿å½¢å¼ã§ã™ã€‚JavaScriptã‹ã‚‰ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§ã®ãƒ‡ãƒ¼ã‚¿ãŒç°¡å˜ã«æ‰±ãˆã‚‹ã“ã¨ãªã©ã‚’ç†ç”±ã«ã€å¤šæ•°ã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§APIã®ä¸€éƒ¨ã¨ã—ã¦JSONPå½¢å¼ã§ãƒ‡ãƒ¼ã‚¿ã®æä¾›ãŒè¡Œã‚ã‚Œã¦ã„ã¾ã™ã€‚ å…·ä½“çš„ãªä¾‹ã‚’è¦‹
yachimon 2009/08/11
javascript

security

*
ãƒªãƒ³ã‚¯
i-mode2.0ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®æ¤œè¨Ž: æºå¸¯JavaScriptã¨XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã®å¯èƒ½æ€§ - å¾³ä¸¸æµ©ã®æ—¥è¨˜(2009-08-05)
_æºå¸¯JavaScriptã¨XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã®å¯èƒ½æ€§ ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€æºå¸¯é›»è©±ã®ãƒ–ãƒ©ã‚¦ã‚¶ã«æè¼‰ã•ã‚ŒãŸJavaScriptã¨ã€Webã‚µã‚¤ãƒˆã®XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚Šã€ã„ã‚ã‚†ã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ã«å¯¾ã™ã‚‹ä¸æ£ãƒã‚°ã‚¤ãƒ³ã®å¯èƒ½æ€§ã«ã¤ã„ã¦æ¤œè¨Žã™ã‚‹ã€‚ 5æœˆ28ã«ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã«æ›¸ã„ãŸæ—¥è¨˜ã€Œi-mode2.0ã¯å‰é€”å¤šé›£ã€ã«ã¦ã€ä»Šå¹´ã®NTTãƒ‰ã‚³ãƒ¢ã®å¤ãƒ¢ãƒ‡ãƒ«P-07Aã«ã¦JavaScriptæ©Ÿèƒ½ãŒåˆ©ç”¨åœæ¢ã•ã‚ŒãŸã“ã¨ã‚’æŒ‡æ‘˜ã—ãŸã€‚åŒæ—¥ä»˜ã®NTTãƒ‰ã‚³ãƒ¢ç¤¾ã®ãƒªãƒªãƒ¼ã‚¹ã«ã‚ˆã‚‹ã¨ã€ã€Œã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢æ›´æ–°ã«ä¼´ã„ã€é«˜åº¦åŒ–ã—ãŸæ©Ÿèƒ½ã®ä¸€éƒ¨ã‚’ã”åˆ©ç”¨ã„ãŸã ã‘ãªããªã£ã¦ã„ã¾ã™ãŒã€å†ã³ã”åˆ©ç”¨ã„ãŸã ã‘ã‚‹ã‚ˆã†é€Ÿã‚„ã‹ã«å¯¾å‡¦ã„ãŸã—ã¾ã™ã€ã¨ã‚ã£ãŸãŒã€ãã‚Œä»¥æ¥2ãƒ¶æœˆä»¥ä¸ŠãŒçµŒã¤ã‚‚ã®ã®ã€æœªã ã«JavaScriptæ©Ÿèƒ½ã¯åˆ©ç”¨ã§ããªã„çŠ¶æ…‹ã®ã¾ã¾ã ã€‚ å®Ÿã¯ã€NTTãƒ‰ã‚³ãƒ¢ç¤¾ãŒæ…Œã¦ãµãŸã‚ã„ã¦JavaScriptæ©Ÿèƒ½ã‚’æ€¥é½åœæ¢
yachimon 2009/08/05
javascript

mobile

security

XSS
ãƒªãƒ³ã‚¯
ãƒšãƒ¼ã‚¸å†…ã®ç”»åƒã®ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã‚’è¶…ç°¡å˜ã«åˆ¶é™ã§ãã‚‹ã€ŒdwImageProtector for jQueryã€:phpspoté–‹ç™ºæ—¥èªŒ
ãƒšãƒ¼ã‚¸å†…ã®ç”»åƒã®ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã‚’è¶…ç°¡å˜ã«åˆ¶é™ã§ãã‚‹ã€ŒdwImageProtector for jQueryã€ 2009å¹´06æœˆ15æ—¥- dwImageProtector Plugin for jQuery ãƒšãƒ¼ã‚¸å†…ã®ç”»åƒã®ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã‚’è¶…ç°¡å˜ã«åˆ¶é™ã§ãã‚‹ã€ŒdwImageProtector for jQueryã€ã€‚ Flickr ãªã©ã§å°Žå…¥ã•ã‚Œã¦ã„ã¾ã™ãŒã€å³ã‚¯ãƒªãƒƒã‚¯ã—ã¦ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ã‚ˆã†ã¨ã™ã‚‹ã¨ã€å…ƒç”»åƒã§ã¯ãªããƒ€ãƒŸãƒ¼ã®ç”»åƒã®ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ãŒé–‹å§‹ã™ã‚‹ã€ã¨ã„ã†ä»•çµ„ã¿ã‚’ç°¡å˜ã«å®Ÿç¾ã™ã‚‹ãŸã‚ã®jQueryãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã§ã™ã€‚ ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ã‚ˆã†ã¨ã™ã‚‹ã¨ã€ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰é–‹å§‹ã™ã‚‹ã‚‚ã®ã®ã€ãƒ€ãƒŸãƒ¼ç”»åƒ(blank.gif)ãŒã‚¿ãƒ¼ã‚²ãƒƒãƒˆã«ãªã‚Šã¾ã™ã€‚ å˜ç´”ã«ã€å…ƒç”»åƒã«ãƒ€ãƒŸãƒ¼ç”»åƒ(blank.gif)ã‚’è¢«ã›ã¦ã„ã‚‹ã¨ã„ã†ãƒãƒƒã‚¯ãªã®ã§ã™ãŒã€ç”»åƒã®å³ã‚¯ãƒªãƒƒã‚¯ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã‚’æŠ‘åˆ¶ã—ãŸã„æ–¹ã«ã¯ä¾¿åˆ©ã«ä½¿ãˆã¾ã™ã€‚ ä»¥ä¸‹ã®ã‚ˆã†ãªã‚±ãƒ¼ã‚¹ã§ä¿å˜ã™
yachimon 2009/06/15
ãªã‚“ã ã‹ãªã‚ã€‚

javascript

security
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - ã€ŒNoScriptã€ã‚’ã‚„ã‚ã¦ã€ŒRequestPolicyã€ã«ã—ãŸ
â– ã€ŒNoScriptã€ã‚’ã‚„ã‚ã¦ã€ŒRequestPolicyã€ã«ã—ãŸ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å±‹ãŒã€Firefoxãƒ¦ãƒ¼ã‚¶ã«ã€ŒNoScriptã€ã®ä½¿ç”¨ã‚’æŽ¨å¥¨ã™ã‚‹ã“ã¨ãŒã—ã°ã—ã°ã‚ã‚‹ãŒã€ç§ã¯è³›åŒã—ãªã„ã€‚ JPCERT/CCã€æŠ€è¡“ãƒ¡ãƒ¢ã€Œå®‰å…¨ãªWebãƒ–ãƒ©ã‚¦ã‚¶ã®ä½¿ã„æ–¹ã€ã‚’å…¬é–‹, INTERNET Watch, 2008å¹´11æœˆ4æ—¥ *1 æŠ€è¡“ãƒ¡ãƒ¢ âˆ’ å®‰å…¨ãªWebãƒ–ãƒ©ã‚¦ã‚¶ã®ä½¿ã„æ–¹, JPCERT/CC, 2008å¹´11æœˆ4æ—¥ IV. å„ Web ãƒ–ãƒ©ã‚¦ã‚¶ã«å…±é€šã™ã‚‹è¨å®šä¸Šã®æ³¨æ„äº‹é … 1. ã‚¹ã‚¯ãƒªãƒ—ãƒˆç‰ã®å®Ÿè¡Œã‚’åˆ¶é™ã™ã‚‹ JavaScript ç‰ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚„ï¼ˆç•¥ï¼‰ã¯ï¼ˆç•¥ï¼‰Ajax ã«ä»£è¡¨ã•ã‚Œã‚‹ã‚¤ãƒ³ã‚¿ãƒ©ã‚¯ãƒ†ã‚£ãƒ–ãªã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ãŒå®Ÿç¾ã§ãã‚‹ãªã©ã€é«˜ã„åˆ©ä¾¿æ€§ãŒå¾—ã‚‰ã‚Œã¾ã™ã€‚åé¢ã€PC ä¸Šã®é‡è¦ãªãƒ•ã‚¡ã‚¤ãƒ«ã‚’å‰Šé™¤ãƒ»å¤‰æ›´ã™ã‚‹ãªã©ã€æ‚ªæ„ã‚’æŒã£ãŸå‡¦ç†ãŒè¡Œã‚ã‚Œã‚‹å¯èƒ½æ€§ã‚‚ã‚ã‚Šã¾ã™ã€‚å¾“ã£ã¦ç„¡åˆ¶é™ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆç‰ã‚’å®Ÿè¡Œã§ãã‚‹ã‚ˆã†ã«ã—ã¦ãŠãã®ã¯
yachimon 2009/05/31
firefox

javascript

security

HiromitsuTakagi
ãƒªãƒ³ã‚¯
i-mode2.0ã¯å‰é€”å¤šé›£ - ockeghem's blog
æ—¢ã«ç™ºè¡¨ã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ã«ã€NTTãƒ‰ã‚³ãƒ¢ã®å¤ãƒ¢ãƒ‡ãƒ«ã‹ã‚‰i-modeã®ä»•æ§˜ãŒå¤§å¹…ã«æ‹¡å¼µã•ã‚Œã€JavaScriptã€Cookieã€Refererã«å¯¾å¿œã™ã‚‹ã‚ˆã†ã«ãªã£ãŸã€‚ã“ã‚Œã‚‰ä»•æ§˜å¤‰æ›´ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®é¢ã‹ã‚‰ã‚‚å½±éŸ¿ãŒå¤§ãã„ãŸã‚ã€ç§ã¯å¤ãƒ¢ãƒ‡ãƒ«ã®ä¸ã‹ã‚‰ã€P-07Aã‚’ç™ºå£²é–‹å§‹æ—¥(5æœˆ22æ—¥)ã«è³¼å…¥ã—ãŸã€‚ãã—ã¦ã€ãƒªãƒªãƒ¼ã‚¹ã©ãŠã‚ŠJavaScriptã€Cookieã€RefererãŒå‹•ä½œã™ã‚‹ã“ã¨ã‚’ã€å®Ÿæ©Ÿã«ã¦ç¢ºèªã—ãŸã€‚ ã¨ã“ã‚ãŒã€P-07Aã¨åŒæ—¥ã«ç™ºå£²é–‹å§‹ã•ã‚ŒãŸN-06Aã¯ã€ãã®æ—¥ã®ã†ã¡ã«ä¸€æ™‚è²©å£²åœæ¢ã®ãŠçŸ¥ã‚‰ã›ãŒå‡ºã‚‹ã€‚ ã“ã®åº¦ã€å¼Šç¤¾ã®æºå¸¯é›»è©±ã€ŒN-06Aã€ã«ãŠã„ã¦ã€iãƒ¢ãƒ¼ãƒ‰æŽ¥ç¶šæ™‚ã®ä¸å…·åˆãŒç¢ºèªã•ã‚Œã¾ã—ãŸã®ã§ã€è²©å£²ã‚’ä¸€æ™‚è¦‹åˆã‚ã›ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ ãªãŠã€æœ¬äº‹è±¡ã«ä¼´ã„ã€æœ¬æ—¥ç™ºè¡¨ã„ãŸã—ã¾ã—ãŸã€ŒN-08Aã€ã®è²©å£²é–‹å§‹æ—¥ã«ã¤ãã¾ã—ã¦ã‚‚ã€5æœˆ28æ—¥ã‹ã‚‰å»¶æœŸã¨ãªã‚Šã¾ã™ã€‚ ã€ŒN-06Aã€ã®è²©å£²å†é–‹åŠã³ã€ŒN-08Aã€ã®è²©å£²é–‹å§‹æ™‚æœŸ
yachimon 2009/05/28
mobile

javascript

security
ãƒªãƒ³ã‚¯
Twitter XSS é¨’å‹• - Yaks
(2009/04/12 6ï¼š40 pm è¿½è¨˜ã—ã¾ã—ãŸ) (2009/04/12 7ï¼š24 pm å†åº¦è¿½è¨˜ã—ã¾ã—ãŸ) å…ˆã»ã©ã‹ã‚‰ Twitterä¸Šã«ã¦ XSS ã®ã‚ˆã‚‹è¢«å®³ãŒå‡ºã¦ã„ã¾ã™ã€‚ æ—¢ã«æµ·å¤–ã®ãƒ–ãƒã‚°ãªã©ã§ã‚‚å–ã‚Šä¸Šã’ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ HOWTO: Remove StalkDaily.com Auto-Tweets From Your Infected Twitter Profile (Twittercsm) Warning: Twitter Hit By StalkDaily Worm (TechCrunch) æ—¢ã« XSS ã®éƒ¨åˆ†ã¯æ”¹ä¿®ã•ã‚Œã¦å¤§åˆ†åŽã¾ã£ãŸã‚ˆã†ã§ã™ãŒã€å¿µã®ãŸã‚ã«æ›¸ã„ã¦ãŠãã¾ã™ã€‚ å†…å®¹ã¨ã—ã¦ã¯ã€ 1. StalkDaily.com ã‚’å®£ä¼ã™ã‚‹ã¤ã¶ã‚„ããŒå‹æ‰‹ã«æŠ•ç¨¿ã•ã‚Œã‚‹ 2. ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã® Web ãŒæ”¹ã–ã‚“ã•ã‚Œã‚‹ 3. æ”¹ã–ã‚“ã•ã‚ŒãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒšãƒ¼ã‚¸ã‚’è¦‹ã‚‹ã¨ã€è‡ªåˆ†ã®ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã‚‚
yachimon 2009/04/12
javascript

twitter

XSS

security
ãƒªãƒ³ã‚¯
ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°å¯¾ç– - ITæˆ¦è¨˜
var allowed = false; if (parent != window) { // è‡ªåˆ†ãŒãƒ•ãƒ¬ãƒ¼ãƒ å†…ãªã‚‰ document.addEventListener('click', function(e) { if (!allowed && confirm('ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚¯ï¼Ÿ')) { e.stopPropagation(); e.preventDefault(); } }, true); } window.addEventListener('message', function(e) { if (e.origin == 'http://example.com/') { // example.com ã‹ã‚‰ã¯è¨±å¯ allowed = true; } }, true); ã¨ã‹ã˜ã‚ƒãƒ€ãƒ¡ã‹ã«ï¼Ÿæ—¢å‡ºï¼Ÿ http://internet.watch.impress.co.jp/cda/news/
yachimon 2009/03/09
javascript

security

amachang
ãƒªãƒ³ã‚¯
javascript - ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚¯æ®ºã—ãªbookmarklet : 404 Blog Not Found
2009å¹´03æœˆ05æ—¥02:30 ã‚«ãƒ†ã‚´ãƒªLightweight Languages javascript - ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚¯æ®ºã—ãªbookmarklet æ„å¤–ãªç›²ç‚¹ã€‚ ä¸»è¦ãƒ–ãƒ©ã‚¦ã‚¶ã™ã¹ã¦ã«å½±éŸ¿ã™ã‚‹ã€Œã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ã€æ”»æ’ƒã¨ã¯ ã—ã‹ã—ã€ ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚¯ - ç´ äººãŒãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚’å‹‰å¼·ã™ã‚‹ãƒ–ãƒã‚° Firefoxãƒ¦ãƒ¼ã‚¶ã¯NoScriptã‚’ä½¿ã†ã‹ã€about:configã‹ã‚‰permissions.default.subdocumentã‚’3ã«ã—ã¾ã—ã‚‡ã†ã€‚ ã¨ã„ã†ã®ã¯ã‚ã¾ã‚Šã«åŽ³ã—ãæ‚²ã—ã„ã€‚å¯¾ç–ã—ã‚ˆã†ã¯æžœãŸã—ã¦ãªã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿ ãã®çµæžœãŒã€ã“ã¡ã‚‰ã€‚ clickUnJack javascript:(function(d,u){var s=d.createElement('script');s.charset='UTF-8';s.src=u;d.body.appendChild(s)})(do
yachimon 2009/03/05
dankogai

javascript

security
ãƒªãƒ³ã‚¯
ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚¯ - ç´ äººãŒãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚’å‹‰å¼·ã—ã¦ã„ãŸãƒ–ãƒã‚°
æœ€è¿‘æµè¡Œã®ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚¯ã«ã¤ã„ã¦ã€ãƒ¡ãƒ¢ç¨‹åº¦ã«ã¾ã¨ã‚ã¦ãŠãã€‚ ä¸€è¨€ã§è¨€ã†ã¨ã€å¤–éƒ¨ã‚µã‚¤ãƒˆã®ãƒœã‚¿ãƒ³ã‚’ãƒ¦ãƒ¼ã‚¶ãŒé–“é•ãˆã¦ã‚¯ãƒªãƒƒã‚¯ã—ã¦ã—ã¾ã†ã‚ˆã†ã«ä»•å‘ã‘ã‚‹ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ãŒã€ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚¯ã§ã‚ã‚‹ã€‚ ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ã£ã¦ã“ã†ã§ã™ã‹ï¼Ÿ ã‚ã‹ã‚Šã¾ã›ã‚“ã§ã¯iframeã‚’CSSã®opacityãƒ—ãƒãƒ‘ãƒ†ã‚£ã‚’åˆ©ç”¨ã—ã¦é€æ˜Žã«ã—ã¦ã€ãã®ä¸‹ã«ãƒ€ãƒŸãƒ¼ã®ãƒœã‚¿ãƒ³ã‚’ç½®ã„ã¦ã„ã‚‹ã€‚ç›®ã«è¦‹ãˆã¦ã„ã‚‹ãƒœã‚¿ãƒ³ã‚’æŠ¼ãã†ã¨ã™ã‚‹ã¨ã€ãã®ä¸Šã«è¢«ã›ã¦ã‚ã‚‹é€æ˜Žãªiframeã®ãƒœã‚¿ãƒ³ãŒæŠ¼ã•ã‚Œã¦ã—ã¾ã†ã€‚ [Sleipnir]No Click Jacking â€” Gistã¯ã“ã®æ”»æ’ƒã«å¯¾ã™ã‚‹é˜²å¾¡æ‰‹æ®µã¨ã—ã¦è€ƒãˆã‚‰ã‚ŒãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚¹ã‚¯ãƒªãƒ—ãƒˆã§ã€é€æ˜Žãªiframeã‚’æ¤œå‡ºã™ã‚‹ã€‚ ã—ã‹ã—ã€opacityä»¥å¤–ã«ã‚‚ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚¯ã‚’ã™ã‚‹æ–¹æ³•ã¯ã‚ã‚‹ã®ã§ä¸ååˆ†ã§ã‚ã‚‹ã€‚ ä¾‹ãˆã° 2009-03-04_2146 - javascripter's library ã«ã‚¹ã‚¯ãƒªãƒ¼ãƒ³ã‚ãƒ£ã‚¹ãƒˆã‚’
yachimon 2009/03/05
security

javascript
ãƒªãƒ³ã‚¯
"><script>alert("\u3053\u3093\u306B\u3061\u306F\u3053\u3093\u306B\u3061\u306F\uFF01\uFF01")</script>ã®äººæ°—è¨˜äº‹ 0ä»¶ - ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯
"><script>alert(" \u3053\u3093\u306B\u3061\u306F\u3053\u3093\u306B\u3061\u306F\uFF01\uFF01")</script>ã®æ¤œç´¢çµæžœ0 - 0 ä»¶ / 0ä»¶
yachimon 2008/11/28
ã²ã£ã‹ã‹ã£ã¡ã‚ƒã£ãŸï¼žï¼œ

ã¯ã¦ãƒ–

ã¯ã¾ã¡ã¡ã‚ƒã‚“

javascript

security
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ç–‘ä¼¼ãƒ€ã‚¤ã‚¢ãƒã‚°ã«ãƒã‚°ã‚¤ãƒ³ãƒ•ã‚©ãƒ¼ãƒ | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
å…¬é–‹: 2025å¹´7æœˆ24æ—¥15æ™‚30åˆ†é ƒ ã€Œæ–°ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã®ç™»éŒ²ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆã¯ä½¿ã£ã¦ã¯ã„ã‘ãªã„ (takagi-hiromitsu.jp)ã€ã€‚ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§ç–‘ä¼¼ãƒ€ã‚¤ã‚¢ãƒã‚°ãŒè¡¨ç¤ºã•ã‚Œã€ãã®ä¸ã«ãƒã‚°ã‚¤ãƒ³ãƒ•ã‚©ãƒ¼ãƒ ãŒç¾ã‚Œã‚‹ã¨ã„ã†ãŠè©±ã€‚ â€»é«˜æœ¨ã•ã‚“ã¯ã€Œãƒšãƒ¼ã‚¸å†…JavaScriptã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã€ã¨å‘¼ã°ã‚Œã¦ã„ã¾ã™ãŒã€ã†ã¡ã®ç¤¾å†…ã§ã¯ã€Œç–‘ä¼¼ãƒ€ã‚¤ã‚¢ãƒã‚°ã€(ç•¥ã—ã¦ã€Œç–‘ä¼¼ãƒ€ã‚¤ã€) ã§é€šã£ã¦ã„ã¾ã™ãã€‚å®Ÿè£…ãŒJavaScriptã‹ã©ã†ã‹ã¨ã„ã†ç‚¹ã¯æœ¬è³ªã§ã¯ã‚ã‚Šã¾ã›ã‚“ã—ã€ã“ã“ã§ã¯ã¨ã‚Šã‚ãˆãšã€Œç–‘ä¼¼ãƒ€ã‚¤ã‚¢ãƒã‚°ã€ã¨å‘¼ã‚“ã§ãŠãã¾ã™ã€‚ ç–‘ä¼¼ãƒ€ã‚¤ã‚¢ãƒã‚°ã«ã¯ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã‚‚ä½•ã‚‚ã‚ã‚Šã¾ã›ã‚“ã—ã€ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§è¡¨ç¤ºã•ã‚Œã¦ã„ã‚‹ã®ã‹ã©ã†ã‹ã‚’åˆ©ç”¨è€…ãŒçŸ¥ã‚‹æ‰‹æ®µã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ã‚ãã¾ã§ã€ãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã®ã¿ã‚’ä¿¡ç”¨ã™ã‚‹ã‚ˆã†ã«ã—ã¦åˆ©ç”¨ã—ãªã„ã¨é§„ç›®ã¨ã„ã†ã“ã¨ã§ã™ãã€‚ é€†ã«ã€ç–‘ä¼¼ãƒ€ã‚¤ã‚¢ãƒã‚°ã‚’ä½¿ã£ãŸã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ã‚¤ã‚¹ã‚’è¨è¨ˆã™ã‚‹éš›ã«ã¯ã€ã“ã†ã„ã†å½¢
yachimon 2008/11/26
ã¯ã¦ãƒ–

security

bookmarklet

javascript
ãƒªãƒ³ã‚¯
1