Rails 2ç³»ã®XSS脆弱性ãŒRuby 1.9ã§ã¯å½±éŸ¿ãªã—ã¨ã•ã‚Œã‚‹ç†ç”± - 岩本隆å²ã®æ—¥è¨˜å¸³ï¼ˆã‚¢ãƒ¼ã‚«ã‚¤ãƒ–）Rails 2ç³»ã®XSS脆弱性を修æ£ã™ã‚‹ãƒ‘ッãƒãŒå…ˆæ—¥å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ 4æ—¥(米国時間)ã€Ruby on Railsã®2ç³»ã™ã¹ã¦ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«XSSã®è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒRiding Rails: XSS Vulnerability in Ruby on Railsã«ãŠã„ã¦ç™ºè¡¨ã•ã‚ŒãŸã€‚特定ã®Unicodeæ–‡å—列を使ã£ã¦ãƒã‚§ãƒƒã‚¯ã‚’ããり抜ã‘ã€ä»»æ„ã®HTMLã‚’é€ã‚Šè¾¼ã¾ã‚Œã‚‹å±é™ºæ€§ãŒã‚る。ãªãŠRuby 1.9ç³»ã§å‹•ä½œã—ã¦ã„るアプリケーションã¯ã“ã®å½±éŸ¿ã‚’å—ã‘ãªã„。 http://journal.mycom.co.jp/news/2009/09/07/048/index.html ã“ã®ä»¶ã«é–¢ã—ã¦ã€å¤§åž£ã•ã‚“ã¯æ¬¡ã®ã‚ˆã†ã«èª¬æ˜Žã—ã¦ã„ã¾ã™ã€‚ RoRã®è„†å¼±æ€§ã«é–¢é€£ã—ã¦Ruby1.9ã§ã¯å®‰å…¨ã€ã¨è§£èª¬ã•ã‚Œã¦ã„ã¾ã™ãŒã€ãã‚Œã¯Ruby1.9ã¯ä¸æ£ãªæ–‡å—エンコーディングをå—ã‘付ã‘ãªã„ã‹ã‚‰ã§ã™ã€‚ 何故ã‹ã‚ãŸã‚Šå‰ã«ãªã‚‰ãªã„æ–‡å—エ
Variable Byte Code 㨠UTF-8ã€ã¾ãŸã¯UTF-24ãŒå˜åœ¨ã—ãªã„ã‚ã‘ : 404 Blog Not Found
javascript: escape(), encodeURI(), encodeURIComponent() 比較 (groundwalker.com)
第4回　UTF-8ã®å†—é•·ãªã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ | gihyo.jp
[ã‚»ã‚ュリティ]javascript://ã®XSS 00:17 - 2008-07-30 - T.Teradaã®æ—¥è¨˜![[ã‚»ã‚ュリティ]javascript://ã®XSS 00:17 - 2008-07-30 - T.Teradaã®æ—¥è¨˜](https://cdn-ak-scissors.b.st-hatena.com/image/square/3ce21f422dafba32f7c257ef3ed09227bfdd2c5e/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F10257846132711010800%2F10257846132711092219%2F1548045373)
図解: Perl 㨠Unicode æ–‡å—列 - daily dayflower
UTF-8 vs. ISO-10646 : 404 Blog Not Found
{{#tags}}- {{label}}
{{/tags}}