[B! security][javascript] higeorangeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

higeorange id:higeorange

securityã¨javascriptã«é–¢ã™ã‚‹higeorangeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

XSSå¯¾ç–:JavaScriptã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—(ãã®2) - ockeghem's blog
5/11ã®æ—¥è¨˜XSSå¯¾ç–:JavaScriptãªã©ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ— - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜ã«å¯¾ã™ã‚‹é‡‘åºŠã•ã‚“ã®ã‚³ãƒ¡ãƒ³ãƒˆã«è§¦ç™ºã•ã‚Œã¦ã€JavaScriptã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã«ã¤ã„ã¦æ¤œè¨Žã—ã¦ã¿ã‚ˆã†ã€‚ãŸã ã—ã€ç¾å®Ÿã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã«ãŠã„ã¦ã¯ã€ç§ã¯JavaScriptã®å‹•çš„ç”Ÿæˆã‚’æŽ¨å¥¨ã—ã¦ã„ãªã„ãŒã€ã“ã‚Œã¯ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã‚’ã©ã®ã‚ˆã†ã«è€ƒãˆã‚‹ã‹ã¨è¨€ã†ãƒ¬ãƒƒã‚¹ãƒ³ã®ã¤ã‚‚ã‚Šã§æ¤œè¨Žã™ã‚‹ã“ã¨ã«ã™ã‚‹ã€‚ é‡‘åºŠã•ã‚“ã®ã‚³ãƒ¡ãƒ³ãƒˆã§ç´¹ä»‹ã•ã‚ŒãŸãƒªãƒ³ã‚¯ã«ã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãªã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³æ¡ˆãŒææ¡ˆã•ã‚Œã¦ã„ã‚‹ã€‚ JavaScriptã®æ–‡å—åˆ—ã§ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹é †ã¨ã—ã¦ã¯ã€ä»¥ä¸‹ãŒä»Šã®ã¨ã“ã‚æ£è§£ã£ã½ã„æ„Ÿã˜ã§ã™ã€‚ 1. ã€Œ\ã€ã‚’ã€Œ\\ã€ã«ç½®æ›ã™ã‚‹ 2. ã€Œ"ã€ã‚’ã€Œ\"ã€ã«ç½®æ›ã™ã‚‹ 3. ã€Œ'ã€ã‚’ã€Œ\'ã€ã«ç½®æ›ã™ã‚‹ 4. ã€Œ/ã€ã‚’ã€Œ\/ã€ã«ç½®æ›ã™ã‚‹ 5. ã€Œ<ã€ã‚’ã€Œ\x3cã€ã«ç½®æ›ã™ã‚‹ 6. ã€Œ>ã€ã‚’ã€Œ\x3eã€ã«ç½®æ›ã™ã‚‹ 7. ã€Œ0x0Dï¼ˆCR)
higeorange 2007/05/15
javascript

security
ãƒªãƒ³ã‚¯
XSSå¯¾ç–:JavaScriptãªã©ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ— - ockeghem's blog
æ˜¨æ—¥ã®æ—¥è¨˜ã«å¯¾ã—ã¦ã€id:ikepyonã•ã‚“ã‹ã‚‰ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ã‚’é ‚æˆ´ã—ãŸã€‚å†…å®¹ã¯ãã¡ã‚‰(Tipsã¨è€ƒãˆæ–¹ã¨XSSå¯¾ç–)ã‚’èªã‚“ã§ã„ãŸã ãã¨ã—ã¦ã€èˆˆå‘³æ·±ã„ãƒ†ãƒ¼ãƒžãªã®ã§å°‘ã—çªã£è¾¼ã‚“ã§ã¿ãŸã„ã€‚ # æ—¥ã«ã‚ˆã£ã¦ã€Œã§ã™ãƒ»ã¾ã™ã€ã§æ›¸ã„ãŸã‚Šã€ã€Œã ãƒ»ã§ã‚ã‚‹ã€ã§æ›¸ã„ã¦ã„ã‚‹ã®ã¯æ°—åˆ†ã®å•é¡Œãªã®ã§ã€ã‚ã¾ã‚Šæ°—ã«ã—ãªã„ã§ã„ãŸã ããŸã„ Tipsã ã‘ã§ãªãã€ç‰©äº‹ã®æœ¬è³ªã‚’è¦‹æ¥µã‚ã€ä½•ãŒå±é™ºã§ã€ä½•ãŒå®‰å…¨ãªã®ã‹ã¨ã„ã†ã“ã¨ã‚’è€ƒãˆã‚‹å¿…è¦ãŒã‚ã‚‹ã¨æ€ã†ã€‚ æ˜¨æ—¥ã®è¨˜äº‹ã¯ã€(ä¸€èˆ¬çš„ãª)XSSå¯¾ç–ã¨ã—ã¦ã€ã©ã®æ–‡å—ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã®ãŒã€Œæœ¬è³ªçš„ã€ã ã£ãŸã‹ã‚’è€ƒãˆãŸã‹ã£ãŸã®ã§ã‚ã£ã¦ã€ã‚ã‚Œã‚’Tipsã¨ã¨ã‚‰ãˆã‚‹ã¨ç¢ºã‹ã«å¤±æ•—ã™ã‚‹ã€‚ JavaScriptã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãªã©ãŒå…¥ã£ã¦ã„ã‚‹å ´åˆã‚‚æ˜¨æ—¥ã¨åŒã˜æ–¹æ³•è«–ã§è€ƒãˆã‚‹ã“ã¨ã¯å¯èƒ½ã§ã‚ã‚‹ã€‚ã¾ãšã¯ã“ã‚Œã‚’æ¤œè¨Žã—ã¦ã¿ã‚ˆã†ã€‚ ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒonXXXã®ã‚¤ãƒ™ãƒ³ãƒˆãƒãƒ³ãƒ‰ãƒ©ã¨ã—ã¦è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹å ´åˆ ã“ã®å ´åˆã¯ã€HTMLã‚¿ã‚°ã®å±žæ€§å€¤ã¨ã—ã¦
higeorange 2007/05/15
javascript

security
ãƒªãƒ³ã‚¯
JavaScript ã‹ã‚‚æ—¥è¨˜: ã€Ajaxã€‘Basicèªè¨¼ãƒšãƒ¼ã‚¸ã‹ã‚‰èªã¿è¾¼ã‚€
TestnetãŒã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã•ã‚ŒãŸã®ã¯çŸ¥ã£ã¦ãŸã‘ã‚Œã©ã€libra-authã®ãƒ‡ãƒ¢ã‚‚å‹•ã‹ãªããªã£ãŸã®ã§ã¡ã‚‡ã£ã¨èª¿â€¦
higeorange 2007/04/11
ajax

javascript

security
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§ã®ãƒ‡ãƒ¼ã‚¿èªã¿è¾¼ã¿ã‚’é˜²æ¢ã™ã‚‹JavaScript ? - snippets from shinichitomitaâ€™s journal
GMailã®ã‚³ãƒ³ã‚¿ã‚¯ãƒˆãƒªã‚¹ãƒˆæ¼æ´©ã®ã‚¨ãƒ³ãƒˆãƒªã®ã¤ã„ã§ã«ã€‚ JSONãƒ‡ãƒ¼ã‚¿ã‚’scriptã‚¿ã‚°ã«ã®ã›ã¦é…ä¿¡ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ï¼ˆJSONPãªã©ï¼‰ã§ã€é™ã‚‰ã‚ŒãŸã‚µã‚¤ãƒˆã®ã¿ã«ã—ã‹ãã®ãƒ‡ãƒ¼ã‚¿ã‚’é…ä¿¡ã—ãªã„ã‚ˆã†ã«ã™ã‚‹ãŸã‚ã«ã¯ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒé€å‡ºã—ã¦ãã‚‹ãƒªãƒ•ã‚¡ãƒ©æƒ…å ±ã‚’ä½¿ã£ã¦ã‚µãƒ¼ãƒ“ã‚¹ã‚³ãƒ³ã‚·ãƒ¥ãƒ¼ãƒžã¨ãªã£ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã‚’ç‰¹å®šã—ã¦ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã™ã‚‹æ–¹æ³•ãŒã‚ã‚‹ã€‚ ã“ã®æ–¹æ³•ã¯ãŠãã‚‰ãå¤§éƒ¨åˆ†ã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆï¼ˆãƒ–ãƒ©ã‚¦ã‚¶ï¼‰ã«å¯¾ã—ã¦ã¯æœ‰åŠ¹ã§ã€ä¾‹ãˆã°å®Ÿéš›ã«Google Mapsãªã©ã‚‚ãã‚Œã¨AppKeyã‚’çµ„ã¿åˆã‚ã›ã¦ã‚µã‚¤ãƒˆã‚’åˆ¤åˆ¥ã—ã¦ã„ã‚‹ã£ã½ã„ã®ã ã‘ã©ã€æ„å›³çš„ã«ãƒªãƒ•ã‚¡ãƒ©é€å‡ºã‚’åˆ‡ã£ã¦ã„ã‚‹ãƒ–ãƒ©ã‚¦ã‚¶ã§ã‚ã£ãŸã‚Šã€ã‚ã‚‹ã„ã¯ãƒ—ãƒã‚ã‚·ãƒ—ãƒã‚°ãƒ©ãƒ ãªã©ãŒè‡ªå‹•çš„ã«ãƒªãƒ•ã‚¡ãƒ©ãƒ˜ãƒƒãƒ€ã‚’é™¤åŽ»ã—ã¦ã—ã¾ã†ã‚ˆã†ãªã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆç’°å¢ƒã«å¯¾ã—ã¦ã¯ç„¡åŠ¹ã«ãªã£ã¦ã—ã¾ã†ã€‚ ã¨ã„ã†ã“ã¨ã§ã€ãã‚“ãªã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã§ã‚‚ãªã‚“ã¨ã‹ãªã‚‰ãªã„ã ã‚ã†ã‹ã¨è€ƒãˆã¦ã„ãŸã¨ãã«ã¡ã‚‡ã£ã¨æ€ã„ã¤ã„ãŸã€ã‚‚ã—ã‹ã—ãŸã‚‰ã“ã®æ–¹æ³•ãªã‚‰è¨±
higeorange 2007/03/30
javascript

json

jsonp

security
ãƒªãƒ³ã‚¯
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚¸ã‚§ãƒãƒ¬ãƒ¼ã‚¿ - JavaScript
Password Generator ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ãƒ©ãƒ³ãƒ€ãƒ ã«ç”Ÿæˆã™ã‚‹ãŠæ‰‹è»½ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚¸ã‚§ãƒãƒ¬ãƒ¼ã‚¿ NN4+, IE4+, Opera ä½¿ç”¨ã™ã‚‹æ–‡å— A-Z ã‚ªãƒ¼ ( O ) ã‚’ä½¿ã† ã‚¢ã‚¤ ( I ) ã‚’ä½¿ã† a-z ã‚¨ãƒ« ( l ) ã‚’ä½¿ã† 0-9 ã‚¼ãƒ ( 0 ) ã‚’ä½¿ã† ã‚¤ãƒ ( 1 ) ã‚’ä½¿ã† ã‚ã‚‰ã‚†ã‚‹è¨˜å· !"#$%&'()-=^~|@`[{;+:*]},<.>/?\_ ä»»æ„ã®æ–‡å— å…¥åŠ›æ–‡å—ã«ç©ºç™½æ–‡å—ã‚’è¦‹ã¤ã‘ãŸã‚‰å–ã‚Šé™¤ã ç”Ÿæˆã™ã‚‹æ–‡å—æ•° æ–‡å— ç”Ÿæˆ çµæžœ [PageTop] [Back] [Home] æ›´æ–°å±¥æ´ 2005-2-24 ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å…¨ã¦æ›¸ãç›´ã— è¤‡æ•°ç”Ÿæˆã§ãã‚‹ã‚ˆã†ã«å¤‰æ›´ ç©ºç™½æ–‡å—ã‚’å–ã‚Šé™¤ããƒã‚§ãƒƒã‚¯ã‚’è¿½åŠ ä½¿ã‚ãªã„æ–‡å—æŒ‡å®šã‚’è¿½åŠ 200x åˆç‰ˆå…¬é–‹ [PageTop] [Back] [Home] Copyright(C) 2002-2005 kerry.
higeorange 2007/03/25
javascript

security
ãƒªãƒ³ã‚¯
Blog Archive - Incompleteness
The blog is about general web development. (Atom feed) MozBlog contains Mozilla stuff - i.e stuff for planet (Atom feed). See also the Archives If it's a choice between incomplete or wrong, side with GÃ¶del. About I'm Joe Walker. I work for Mozilla making developer tools better i.e. creating tomorrow's Firebug. See also joewalker on Github and @joewalker on Twitter, and 103130341946168853745 on Goo
higeorange 2007/03/07
javascript

json

security
ãƒªãƒ³ã‚¯
Ajaxian Â» The safety of JSON
Enterprise Strategy Group: Go-to-market Expertise to Help You Win
higeorange 2007/03/06
ajaxian

javascript

json

security
ãƒªãƒ³ã‚¯
ITMediaã«ã¨ã‚“ã§ã‚‚ãªãå±é™ºãªLifeHackãŒè¼‰ã£ã¦ã‚‹ä»¶ - nak2kã®ãƒ–ãƒã‚°
ã—ã‹ã‚‚ã€ã€Œmshta ï¼»ä»»æ„ã®URLï¼½ã€ã¨å…¥åŠ›ã™ã‚Œã°ã€Webãƒšãƒ¼ã‚¸ã‚’HTAï¼ˆHTMLã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ï¼‰ã¨ã—ã¦é–‹ãã“ã¨ã‚‚å¯èƒ½ã ã€‚ ã€Œãƒ•ã‚¡ã‚¤ãƒ«åã‚’æŒ‡å®šã—ã¦å®Ÿè¡Œã€ã®ä¾¿åˆ©ãªä½¿ã„æ–¹ï¼ˆãã®1ï¼‰ - ITmedia ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º ã“ã®Tipsã€HTMLã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¨ã—ã¦Webãƒšãƒ¼ã‚¸ã‚’å®Ÿè¡Œã—ãŸå ´åˆã¯IEã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¾ãƒ¼ãƒ³ãŒãƒãƒ¼ã‚«ãƒ«ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã®çŠ¶æ…‹ã§å®Ÿè¡Œã•ã‚Œã‚‹ã‹ã‚‰ã€è¡¨ç¤ºã—ãŸWebãƒšãƒ¼ã‚¸ã§ã¯ã€Œã©ã‚“ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆã§ã‚‚ã€å‹•ã‹ã›ã¦ã‹ãªã‚Šå±é™ºã€‚ ä»¥ä¸‹ã®ã‚ˆã†ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆï¼ˆMicrosoftã®JScriptã«ã¤ã„ã¦ã®ãƒ˜ãƒ«ãƒ—ã«è¼‰ã£ã¦ã‚‹ã‚µãƒ³ãƒ—ãƒ«ï¼‰ã‚’å«ã‚“ã HTMLã‚’ä¸Šè¨˜ã®æ–¹æ³•ã§è¡¨ç¤ºã—ã¦ã¿ãŸã‚ˆã€‚ <script> var fso = new ActiveXObject("Scripting.FileSystemObject"); var a = fso.CreateTextFile("c:\\testfile.txt"
higeorange 2007/03/04
ie

javascript

security
ãƒªãƒ³ã‚¯
https://labs.cybozu.co.jp/blog/kazuho/archives/2007/01/crosssite_security.php
higeorange 2007/01/05
javascript

security
ãƒªãƒ³ã‚¯
ã‚ãªãŸã®ã‚¯ãƒªãƒƒãƒ—ãƒœãƒ¼ãƒ‰ãŒç›—ã¾ã‚Œã‚‹ - Ceekz Logs
IE ã«ã¯ã€ä¾¿åˆ©ãªæ©Ÿèƒ½ãŒã‚ã‚‹ã€‚ãã‚Œã¯ã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆï¼ˆJavaScript etc..ï¼‰ã§ã‚¯ãƒªãƒƒãƒ—ãƒœãƒ¼ãƒ‰ã®æ“ä½œãŒã§ãã‚‹ã®ã ã€‚clipboardData ã¨ã„ã†ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆãã€‚æ“ä½œã§ãã‚‹å†…å®¹ã¯ã€ã‚¯ãƒªãƒƒãƒ—ãƒœãƒ¼ãƒ‰ã«ãƒ‡ãƒ¼ã‚¿ã‚’èªã¿è¾¼ã‚€ã“ã¨ï¼ˆsetDataï¼‰ã€èªã¿å‡ºã™ã“ã¨ï¼ˆgetDataï¼‰ã€æ¶ˆåŽ»ã™ã‚‹ã“ã¨ï¼ˆclearDataï¼‰ã®3ç¨®é¡žã€‚ èªã¿å‡ºã™ã“ã¨ã‚‚å¯èƒ½ãªã‚“ã§ã™ã‚ˆãã€‚ã—ã‹ã‚‚ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã¯ã€è¦å‘Šã™ã‚‰å‡ºãªã„ã€‚ ä»¥ä¸‹ã®ã‚ˆã†ãªã€ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’æº–å‚™ã—ã‚ˆã†ã€‚ #!/usr/bin/perl use strict; my $file = '/tmp/cb.txt'; open (CB, ">> $file"); print CB "$ENV{'QUERY_STRING'}\n"; close (CB); print "Status: 301 Moved Permanently\n"; print "Location:
higeorange 2005/11/24
ie

javascript

security
ãƒªãƒ³ã‚¯
Tweak by Rijk
higeorange 2005/10/25
UserScript in Opera is save, so far---Operaã®UserJavascriptã¯ã‚»ã‚ãƒ¥ã‚¢ã‚‰ã—ã„ã€‚ã€‚

Opera

Javascript

Security
ãƒªãƒ³ã‚¯
1