[B! ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—] monjudohã®ãƒ

monjudoh id:monjudoh

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã«é–¢ã™ã‚‹monjudohã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (13)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

CDATAã‚»ã‚¯ã‚·ãƒ§ãƒ³ã‚’æ£ã—ãã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹æ–¹æ³• - ãƒ’ãƒ«ã‚ºã§åƒã@robarioã®æŠ€ãƒã‚°
<![CDATA[ï¼ˆã“ã“ï¼‰]]> ï¼ˆã“ã“ï¼‰ã¯ç¢ºã‹ã«HTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ãªãã¦ã‚‚ã„ã„ã‚“ã ã‘ã©ã€ï¼ˆã“ã“ï¼‰ã«äºˆæœŸã›ã¬"]]>"ãŒç¾ã‚Œã‚‹ã¨ãã“ã§CDATAã‚»ã‚¯ã‚·ãƒ§ãƒ³ãŒçµ‚ã‚ã£ã¦ã—ã¾ã†ã€‚ ã ã‹ã‚‰ï¼ˆã“ã“ï¼‰ã«"]]>"ã¨ã„ã†å—é¢ãŒç¾ã‚Œãªã„ã‚ˆã†ã«ã—ãªã„ã¨ã„ã‘ãªã„ã®ã§ã€ å…¨ã¦ã® ]]> ã‚’ ]]]]><![CDATA[> ã«ç½®ãæ›ãˆã‚‹ã€‚ åˆ†æ–ã®ä»•æ–¹ã«ã‚ˆã£ã¦ä»–ã«ã‚‚æ›¸ãæ–¹ãŒã‚ã£ã¦ã€ãƒ‘ã‚¿ãƒ¼ãƒ³ã¯ä»¥ä¸‹ã®é€šã‚Šã«ãªã‚‹ã€‚ ]]]]><![CDATA[> ]] ]]> <![CDATA[ > â†‘"]]" â†‘CDATAçµ‚äº† â†‘CDATAé–‹å§‹ â†‘">" ]]]>]<![CDATA[> ] ]]> ] <![CDATA[ > â†‘"]" â†‘CDATAçµ‚äº† â†‘"]" â†‘CDATAé–‹å§‹ â†‘">" ]]]><![CDATA[]> ] ]]> <![CDATA[ ]> â†‘"]" â†‘CDATAçµ‚äº† â†‘CDATAé–‹å§‹ â†‘"]>" ]]>]]<![
monjudoh 2010/12/13
XML

CDATAã‚»ã‚¯ã‚·ãƒ§ãƒ³

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®é–“é•ã£ãŸã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦ : 404 Blog Not Found
2010å¹´09æœˆ22æ—¥21:30 ã‚«ãƒ†ã‚´ãƒªLightweight Languages æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®é–“é•ã£ãŸã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦ æ˜¨æ™©ã®twitter XSSç¥ã‚Šã¯ã€ãµã ã‚“ã‚‚twitter.comã¯ä½¿ã‚ãªã„ç§ã«ã¯é ãã®ç¥ã‚Šå›ƒåã ã£ãŸã®ã§ã™ãŒã€ã›ã£ã‹ãã®è‡ªæˆ’ã®æ©Ÿä¼šãªã®ã§ã€‚ Kazuho@Cybozu Labs: (Twitter ã® XSS è„†å¼±æ€§ã«é–¢é€£ã—ã¦) æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®æ£ã—ã„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦ æ£ã—ã„ã‚¢ãƒ—ãƒãƒ¼ãƒã¯ã€å…¨ã¦ã®ãƒ«ãƒ¼ãƒ«ã‚’åŒæ™‚ã«é©ç”¨ã™ã‚‹ã“ã¨ã§ã™ã€‚ ã“ã‚Œã¯æ®‹å¿µãªãŒã‚‰(ãŠãã‚‰ã)å¿…è¦æ¡ä»¶ã§ã‚ã£ã¦ã‚‚ååˆ†æ¡ä»¶ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ ã“ã†ã„ã†(ã‹ãªã‚Šãˆãˆã‹ã’ã‚“ãª)æ£è¦è¡¨ç¾ã§tweetã‚’parseã—ã¦ã„ãŸã¨ã—ã¾ã™ã€‚ re_http = '(?:https?://[\\x21-\\x7e]+)'; re_user = '(?:[@][0-9A-Za-z_]{1,15})'; re_hash
monjudoh 2010/09/24
id:zorio HTMLã‚’ä½œã‚‹ã®ã¯æœ¬è³ªçš„ã«ãƒ†ã‚ã‚¹ãƒˆå‡¦ç†ã§ã¯ãªã„ã€‚DOMãƒ„ãƒªãƒ¼ã¨ã„ã†ãƒ‡ãƒ¼ã‚¿æ§‹é€ ã‚’ã‚·ãƒªã‚¢ãƒ©ã‚¤ã‚ºã—ãŸã®ãŒHTMLãªã®ã§ã€ãƒ†ã‚ã‚¹ãƒˆå‡¦ç†ã§ã‚„ã£ã¦ã„ã‚‹ã‚‚ã®ã¯å…¨ã¦ç°¡æ˜“ç‰ˆã«éŽãŽãªã„ã¨ã„ã†ã®ã‚’å¿˜ã‚Œã¦ã¯ã„ã‘ãªã„ã€‚

HTML

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
monjudoh 2010/08/30
StringãŒHTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ¸ˆã¿ã‹ã©ã†ã‹ã®ãƒ•ãƒ©ã‚°ã‚’æŒã¤ã®ã§å¤šé‡ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å¿ƒé…ã¯ãªã„ãã†ã ã€‚

Rails

Ruby

Rails3

ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ³

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
Google Slides: Sign-in
Not your computer? Use a private browsing window to sign in. Learn more
monjudoh 2010/02/10
ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®è©±ãŒå‡„ããŸã‚ã«ãªã£ãŸ

HTML

ã‚¹ãƒ©ã‚¤ãƒ‰

è³‡æ–™

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
XPath ã«æ–‡å—åˆ—ã‚’åŸ‹ã‚è¾¼ã‚€ã¨ãã®æ³¨æ„ - ITæˆ¦è¨˜
ã‚ˆãã€ä»¥ä¸‹ã®ã‚ˆã†ã« XPath ã«æ–‡å—åˆ—ã‚’åŸ‹ã‚è¾¼ã‚€äº‹ãŒã‚ã‚Šã¾ã™ document.evaluate('//*[@class="' + text + '"]', document, null, 7, null); ã¾ã‚ã€åƒ•ã‚‚ã‚ˆãã“ã‚“ãªã‚³ãƒ¼ãƒ‰æ›¸ãã‚“ã§ã™ã‘ã©ã€‚ ã§ã‚‚ã€ã“ã‚Œã£ã¦ text ãŒå¤–éƒ¨ã‹ã‚‰æ¥ã‚‹ã‚‚ã®ã ã£ãŸã‚‰ã€æ„å›³é€šã‚Šã®å‹•ä½œã‚’ã—ãªã„ã‚“ã§ã™ã‚ˆã ãŸã¨ãˆã°ã€ä»¥ä¸‹ã®ã‚ˆã†ãªä¾‹ã§ã™ã€‚ var text = '"] | /hoge/fuga/piyo | .["'; document.evaluate('//*[@class="' + text + '"]', document, null, 7, null); ã¨ã„ã†ã‚ã‘ã§ ä»»æ„ã®æ–‡å—åˆ—ã‚’ XPath ã®å¼ã«å¤‰æ›ã™ã‚‹ JavaScript ã‚’æ›¸ã„ã¦ã¿ãŸ ä»¥ä¸‹ã§è©¦ã›ã¾ã™ http://amachang.sakura.ne.jp/misc/xpath_es
monjudoh 2009/09/24
ã€Žã€Œæ–‡è„ˆã€ã¨ã€Œä»»æ„ã®ãƒ‡ãƒ¼ã‚¿ã€ãŒã‚ã‚Œã°ã€ã‚„ã£ã±ã‚Šãã“ã«ã¯ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å¿…è¦æ€§ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ã‚’å¿˜ã‚Œã¦ã¯ã„ã‘ã¾ã›ã‚“ãã€

JavaScript

XPath

library

tips

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
monjudoh 2009/06/09
Perl

TT

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
ã¾ã ã¾ã ã‚ã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒæ³•
å‰å›žã¯ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®ãœã„å¼±æ€§ã‚’çªãæ”»æ’ƒã®å¯¾ç–ã¨ã—ã¦ã®HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã®æœ‰åŠ¹æ€§ã‚’è¿°ã¹ãŸã€‚ãŸã ï¼ŒHTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã ã‘ã§ã¯ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒã‚’å®Œå…¨ã«é˜²å¾¡ã™ã‚‹ã“ã¨ã¯ã§ããªã„ã€‚ãã“ã§ä»Šå›žã¯ï¼ŒHTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã§å¯¾å‡¦ã§ããªã„ã‚¿ã‚¤ãƒ—ã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒã®æ‰‹å£ã¨ï¼Œãã®å¯¾ç–ã«ã¤ã„ã¦è§£èª¬ã™ã‚‹ã€‚ HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã§å¯¾å‡¦ã§ããªã„æ”»æ’ƒã«ã¯ï¼Œæ¬¡ã®ã‚ˆã†ãªã‚‚ã®ãŒã‚ã‚‹ã€‚ ã‚¿ã‚°æ–‡å—ã®å…¥åŠ›ã‚’è¨±å®¹ã—ã¦ã„ã‚‹å ´åˆï¼ˆWebãƒ¡ãƒ¼ãƒ«ï¼Œãƒ–ãƒã‚°ãªã©ï¼‰ CSSï¼ˆã‚«ã‚¹ã‚±ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãƒ»ã‚¹ã‚¿ã‚¤ãƒ«ã‚·ãƒ¼ãƒˆï¼‰ã®å…¥åŠ›ã‚’è¨±å®¹ã—ã¦ã„ã‚‹å ´åˆï¼ˆãƒ–ãƒã‚°ãªã©ï¼‰ æ–‡å—ã‚³ãƒ¼ãƒ‰ã‚’æ˜Žç¤ºã—ã¦ã„ãªã„ã‚±ãƒ¼ã‚¹ã§UTF-7æ–‡å—ã‚³ãƒ¼ãƒ‰ã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° <SCRIPT>ã®å†…å®¹ã‚’å‹•çš„ã«ç”Ÿæˆã—ã¦ã„ã‚‹å ´åˆ Aã‚¿ã‚°ãªã©ã®URLã‚’å‹•çš„ã«ç”Ÿæˆã—ã¦ã„ã‚‹å ´åˆæ³¨ï¼‰ ä»¥ä¸‹ã§ã¯ï¼ŒHTMLã‚¿ã‚°ã‚„CSSã®å…¥åŠ›ã‚’è¨±å®¹ã—ã¦ã„ã‚‹å ´åˆã¨ï¼Œæ–‡å—ã‚³ãƒ¼ãƒ‰ã‚’æ˜Ž
monjudoh 2007/07/04
ã€ŽCSSå…¥åŠ›ã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã€â†’expressionã‚’ä½¿ã£ã¦jsã‚’ä»•è¾¼ã‚€ã€€ä»–ã«ã€ŽUTF-7ã‚’åˆ©ç”¨ã—ãŸã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã€

html

JavaScript

xss

css

web

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
å¯¾ç–é…ã‚‰ã›ã‚‹HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®ã€Œç¥žè©±ã€
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¨ã„ã†è¨€è‘‰ã¯å…ƒã€…ï¼ŒWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰æ¼ã‚Œãªã©ã‚’åˆ©ç”¨ã™ã‚‹ã“ã¨ã«ã‚ˆã£ã¦ç¬¬ä¸‰è€…ã«JavaScriptã‚’å®Ÿè¡Œã•ã›ã‚‹æ‰‹æ³•ã‚’æŒ‡ã™ã€‚åºƒç¾©ã§ã¯ï¼ŒHTMLã®ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã«ã‚ˆã‚‹ç”»é¢æ”¹å¤‰ãªã©ã‚’å«ã‚€ã“ã¨ã‚‚ã‚ã‚‹ã€‚ å‰å›žè¿°ã¹ãŸã‚ˆã†ã«ï¼Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®ãœã„å¼±æ€§ã¯Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«è¦‹ä»˜ã‹ã‚‹ãœã„å¼±æ€§ã®åŠåˆ†ä»¥ä¸Šã‚’å ã‚ã‚‹ã€‚æ•°å¹´å‰ã‹ã‚‰æŒ‡æ‘˜ã•ã‚Œã¦ã„ã‚‹ã«ã‚‚ã‹ã‹ã‚ã‚‰ãšï¼Œä¸€å‘ã«ãªããªã‚‰ãªã„ã€‚ãã®ç†ç”±ã¨ã—ã¦ï¼Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°å¯¾ç–ã‚ã‚‹ã„ã¯HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰æ³¨1ï¼‰ã«å¯¾ã™ã‚‹ã€Œç¥žè©±ã€ãŒã‚ã‚Šï¼Œæ£ã—ã„å¯¾ç–ã®æ™®åŠã‚’é…ã‚‰ã›ã¦ã„ã‚‹ã‚ˆã†ã«æ€ã†ã€‚ãã®ã€Œç¥žè©±ã€ã®æ•°ã€…ã«ã¤ã„ã¦èª¬æ˜Žã—ã‚ˆã†ã€‚ æ³¨1ï¼‰å®Ÿä½“å‚ç…§ï¼ˆentity referenceï¼‰ã¨ã„ã†ã®ãŒæ£å¼ã ãŒï¼Œã‚ã¾ã‚Šæ™®åŠã—ã¦ã„ãªã„ç”¨èªžãªã®ã§ï¼ŒHTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã¨ã„ã†ç”¨èªžã‚’ç”¨ã„ã‚‹ ã€Œã™ã¹ã‹ã‚‰ãHTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã™ã¹ã—ã€ãŒé‰„å‰‡ HTM
monjudoh 2007/07/04
ã‚·ãƒ³ãƒ—ãƒ«ã«ã¾ã¨ã¾ã£ã¦ã¾ã™ã€‚

html

web

xss

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
XSSå¯¾ç–:JavaScriptã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—(ãã®3) - ockeghem's blog
5/14ã®æ—¥è¨˜XSSå¯¾ç–:JavaScriptã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—(ãã®2) - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜ã«å¯¾ã—ã¦ã€id:hasegawayosukeã•ã‚“ã‹ã‚‰ã‚³ãƒ¡ãƒ³ãƒˆã‚’é ‚æˆ´ã—ãŸã€‚ãã®å†…å®¹ã¯ã€JavaScriptã«å¯¾å¿œã—ã¦ã„ãªã„ãƒ–ãƒ©ã‚¦ã‚¶ã®å ´åˆã«å¯¾ã™ã‚‹è€ƒæ…®ãŒæŠœã‘ã¦ã„ã‚‹ã¨ã„ã†è¶£æ—¨ã ã¨ç†è§£ã—ãŸã€‚ å…ƒã®æ—¥è¨˜ã«ã‚‚æ›¸ã„ãŸã‚ˆã†ã«ã€ç§è‡ªèº«ã¯JavaScriptã®å‹•çš„ç”Ÿæˆã¯(ç‰¹æ®Šãªå ´åˆã‚’é™¤ã„ã¦)å¥½ã¾ã—ããªã„ã¨è€ƒãˆã¦ã„ã‚‹ãŒã€å§‹ã‚ãŸä»¥ä¸Šã¯æœ€å¾Œã¾ã§æ¤œè¨Žã—ã‚ˆã†ã¨æ€ã†ã€‚ è§£æ±ºã™ã¹ãèª²é¡Œã®æ•´ç† ã¾ãšã€è§£æ±ºã™ã¹ãèª²é¡Œã‚’æ•´ç†ã—ã‚ˆã†ã€‚å…ƒã®æ—¥è¨˜ã§ã¯ã€JavaScriptã‚’å‹•çš„ç”Ÿæˆã™ã‚‹(ãŸã ã—ã€æ–‡å—åˆ—ãƒªãƒ†ãƒ©ãƒ«å†…ã®ãƒ‡ãƒ¼ã‚¿ã«é™ã‚‹)å ´åˆã®XSSå¯¾ç–ã¨ã—ã¦äºŒæ®µéšŽã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ãŒå¿…è¦ã§ã‚ã‚‹ã“ã¨ã‚’èª¬æ˜Žã—ãŸã€‚å…·ä½“çš„ã«ã¯ã€(1)JavaScriptæ–‡å—åˆ—ãƒªãƒ†ãƒ©ãƒ«ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã¨ã—ã¦ã€ã€Œ"ã€ã€ã€Œ'ã€ã€ã€Œ\ã€ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å®Ÿæ–½ã€(2)HTMLã¨ã—ã¦ã®ã‚¨ã‚¹
monjudoh 2007/07/04
ã€ŽJavaScriptã«å¯¾å¿œã—ã¦ã„ãªã„ãƒ–ãƒ©ã‚¦ã‚¶ã®å ´åˆã«å¯¾ã™ã‚‹è€ƒæ…®ã€jsã¨ã—ã¦è§£é‡ˆã•ã‚Œãªã‹ã£ãŸ-->ã§SCRIPTã‚¿ã‚°å†…ã®ãŒé€”ä¸ã§åˆ‡ã‚‰ã‚Œã¦ã—ã¾ã†ã“ã¨ãŒã‚ã‚‹ã‚“ã§ã™ã¨ã€‚

html

JavaScript

xss

web

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
XSSå¯¾ç–:JavaScriptã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—(ãã®2) - ockeghem's blog
5/11ã®æ—¥è¨˜XSSå¯¾ç–:JavaScriptãªã©ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ— - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜ã«å¯¾ã™ã‚‹é‡‘åºŠã•ã‚“ã®ã‚³ãƒ¡ãƒ³ãƒˆã«è§¦ç™ºã•ã‚Œã¦ã€JavaScriptã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã«ã¤ã„ã¦æ¤œè¨Žã—ã¦ã¿ã‚ˆã†ã€‚ãŸã ã—ã€ç¾å®Ÿã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã«ãŠã„ã¦ã¯ã€ç§ã¯JavaScriptã®å‹•çš„ç”Ÿæˆã‚’æŽ¨å¥¨ã—ã¦ã„ãªã„ãŒã€ã“ã‚Œã¯ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã‚’ã©ã®ã‚ˆã†ã«è€ƒãˆã‚‹ã‹ã¨è¨€ã†ãƒ¬ãƒƒã‚¹ãƒ³ã®ã¤ã‚‚ã‚Šã§æ¤œè¨Žã™ã‚‹ã“ã¨ã«ã™ã‚‹ã€‚ é‡‘åºŠã•ã‚“ã®ã‚³ãƒ¡ãƒ³ãƒˆã§ç´¹ä»‹ã•ã‚ŒãŸãƒªãƒ³ã‚¯ã«ã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãªã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³æ¡ˆãŒææ¡ˆã•ã‚Œã¦ã„ã‚‹ã€‚ JavaScriptã®æ–‡å—åˆ—ã§ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹é †ã¨ã—ã¦ã¯ã€ä»¥ä¸‹ãŒä»Šã®ã¨ã“ã‚æ£è§£ã£ã½ã„æ„Ÿã˜ã§ã™ã€‚ 1. ã€Œ\ã€ã‚’ã€Œ\\ã€ã«ç½®æ›ã™ã‚‹ 2. ã€Œ"ã€ã‚’ã€Œ\"ã€ã«ç½®æ›ã™ã‚‹ 3. ã€Œ'ã€ã‚’ã€Œ\'ã€ã«ç½®æ›ã™ã‚‹ 4. ã€Œ/ã€ã‚’ã€Œ\/ã€ã«ç½®æ›ã™ã‚‹ 5. ã€Œ<ã€ã‚’ã€Œ\x3cã€ã«ç½®æ›ã™ã‚‹ 6. ã€Œ>ã€ã‚’ã€Œ\x3eã€ã«ç½®æ›ã™ã‚‹ 7. ã€Œ0x0Dï¼ˆCR)
monjudoh 2007/07/04
ã€Žç¾å®Ÿã®é–‹ç™ºã«ãŠã„ã¦ã¯JavaScriptã®å‹•çš„ç”Ÿæˆã‚’ã›ãšã€hidden fieldå€¤ã‚’å‚ç…§ã™ã‚‹ã¹ãã§ã‚ã‚‹ã€‚ã€

JavaScript

xss

html

web

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
XSSå¯¾ç–:JavaScriptãªã©ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ— - ockeghem's blog
æ˜¨æ—¥ã®æ—¥è¨˜ã«å¯¾ã—ã¦ã€id:ikepyonã•ã‚“ã‹ã‚‰ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ã‚’é ‚æˆ´ã—ãŸã€‚å†…å®¹ã¯ãã¡ã‚‰(Tipsã¨è€ƒãˆæ–¹ã¨XSSå¯¾ç–)ã‚’èªã‚“ã§ã„ãŸã ãã¨ã—ã¦ã€èˆˆå‘³æ·±ã„ãƒ†ãƒ¼ãƒžãªã®ã§å°‘ã—çªã£è¾¼ã‚“ã§ã¿ãŸã„ã€‚ # æ—¥ã«ã‚ˆã£ã¦ã€Œã§ã™ãƒ»ã¾ã™ã€ã§æ›¸ã„ãŸã‚Šã€ã€Œã ãƒ»ã§ã‚ã‚‹ã€ã§æ›¸ã„ã¦ã„ã‚‹ã®ã¯æ°—åˆ†ã®å•é¡Œãªã®ã§ã€ã‚ã¾ã‚Šæ°—ã«ã—ãªã„ã§ã„ãŸã ããŸã„ Tipsã ã‘ã§ãªãã€ç‰©äº‹ã®æœ¬è³ªã‚’è¦‹æ¥µã‚ã€ä½•ãŒå±é™ºã§ã€ä½•ãŒå®‰å…¨ãªã®ã‹ã¨ã„ã†ã“ã¨ã‚’è€ƒãˆã‚‹å¿…è¦ãŒã‚ã‚‹ã¨æ€ã†ã€‚ æ˜¨æ—¥ã®è¨˜äº‹ã¯ã€(ä¸€èˆ¬çš„ãª)XSSå¯¾ç–ã¨ã—ã¦ã€ã©ã®æ–‡å—ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã®ãŒã€Œæœ¬è³ªçš„ã€ã ã£ãŸã‹ã‚’è€ƒãˆãŸã‹ã£ãŸã®ã§ã‚ã£ã¦ã€ã‚ã‚Œã‚’Tipsã¨ã¨ã‚‰ãˆã‚‹ã¨ç¢ºã‹ã«å¤±æ•—ã™ã‚‹ã€‚ JavaScriptã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãªã©ãŒå…¥ã£ã¦ã„ã‚‹å ´åˆã‚‚æ˜¨æ—¥ã¨åŒã˜æ–¹æ³•è«–ã§è€ƒãˆã‚‹ã“ã¨ã¯å¯èƒ½ã§ã‚ã‚‹ã€‚ã¾ãšã¯ã“ã‚Œã‚’æ¤œè¨Žã—ã¦ã¿ã‚ˆã†ã€‚ ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒonXXXã®ã‚¤ãƒ™ãƒ³ãƒˆãƒãƒ³ãƒ‰ãƒ©ã¨ã—ã¦è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹å ´åˆ ã“ã®å ´åˆã¯ã€HTMLã‚¿ã‚°ã®å±žæ€§å€¤ã¨ã—ã¦
monjudoh 2007/07/04
JavaScript

web

html

xss

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
å¯¾ç–é…ã‚‰ã›ã‚‹HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®ã€Œç¥žè©±ã€ï¼šITpro - è‘‰ã£ã±æ—¥è¨˜
ã¯ã¦ãƒ–ã§ ã€Œã™ã¹ã¦ã‚’ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã™ã‚‹ã¨æ±ºã‚ãŸã€ã¨ã„ã„ãªãŒã‚‰ãƒ¡ã‚¿ã‚ãƒ£ãƒ©ã‚¯ã‚¿ã—ã‹ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ãªã„ã®ã¯ãªãœï¼Ÿ ã¨æ›¸ã„ãŸã‚‰ã€b:id:HiromitsuTakagi ã•ã‚“ã« /â†“hasegawayosukeã€Œãªãœã€<æ„å‘³ä¸æ˜Ž / ã¨è¨€ã‚ã‚Œã¦ã—ã¾ã„ã¾ã™ãŸã€‚ å…¨ã¦ã®æ–‡å—ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã‚ˆã†ãªã©ã¨éžç¾å®Ÿçš„ãªã“ã¨ã¯è¨€ã‚ãªã„ã‘ã‚Œã©(ã¨ã¯ã„ãˆMicrosoft Anti-Cross Site Scripting Libraryã®ã‚ˆã†ã«ã»ã¨ã‚“ã©å…¨ã¦ã®æ–‡å—ã‚’å®Ÿä½“å‚ç…§ã«ç½®ãæ›ãˆã‚‹ã‚‚ã®ã‚‚ã‚ã‚‹ã®ã§ã€ã‚ãªãŒã¡éžç¾å®Ÿçš„ã¨ã‚‚è¨€ãˆãªã„ã®ã‹ã‚‚çŸ¥ã‚Œãªã„)ã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å¯¾è±¡ã‚’ã€Œ'ã€ã€Œ"ã€ã€Œ<ã€ã€Œ>ã€ã€Œ&ã€ã®5æ–‡å—ã«é™å®šã—ã¦ã„ã‚‹ã®ã¯ä½•ã‹ã“ã®è¨˜äº‹ã«æ›¸ã‹ã‚Œã¦ã„ãªã„ç†ç”±ãŒã‚ã‚‹ã¯ãšã ã¨æ€ã£ãŸã‹ã‚‰ã§ã™ã€‚ ã“ã®5æ–‡å—ã•ãˆç¢ºå®Ÿã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã¦ã„ã‚Œã° XSS ãŒé˜²ã’ã‚‹ã‹ã¨ã„ã†ã¨ã€å¤šåˆ†ãã†ã§ã‚‚ãªã„ã ã‚ã†ã¨å€‹äººçš„ã«ã¯æ€ã†ã‚ã‘ã§ã—ã¦ã€‚ ä¾‹ãˆã° IE ã§ã¯ãƒãƒƒã‚¯ã‚¯
monjudoh 2007/07/04
html

web

xss

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜ - XSSå¯¾ç–:ã©ã®æ–‡å—ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã¹ããªã®ã‹ ï¼ ã‚³ãƒ¡ãƒ³ãƒˆ#1
ITproã®é€£è¼‰ä¸ã«ã€id:hasegawayosukeã•ã‚“ã‹ã‚‰ä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¡ãƒ³ãƒˆã‚’ã„ãŸã ã„ã¦ã„ã¾ã—ãŸã€‚ å¯¾ç–é…ã‚‰ã›ã‚‹HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®ã€Œç¥žè©±ã€ï¼šITpro - è‘‰ã£ã±æ—¥è¨˜ å…¨ã¦ã®æ–‡å—ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã‚ˆã†ãªã©ã¨éžç¾å®Ÿçš„ãªã“ã¨ã¯è¨€ã‚ãªã„ã‘ã‚Œã©(ã¨ã¯ã„ãˆMicrosoft Anti-Cross Site Scripting Libraryã®ã‚ˆã†ã«ã»ã¨ã‚“ã©å…¨ã¦ã®æ–‡å—ã‚’å®Ÿä½“å‚ç…§ã«ç½®ãæ›ãˆã‚‹ã‚‚ã®ã‚‚ã‚ã‚‹ã®ã§ã€ã‚ãªãŒã¡éžç¾å®Ÿçš„ã¨ã‚‚è¨€ãˆãªã„ã®ã‹ã‚‚çŸ¥ã‚Œãªã„)ã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å¯¾è±¡ã‚’ã€Œ'ã€ã€Œ"ã€ã€Œ<ã€ã€Œ>ã€ã€Œ&ã€ã®5æ–‡å—ã«é™å®šã—ã¦ã„ã‚‹ã®ã¯ä½•ã‹ã“ã®è¨˜äº‹ã«æ›¸ã‹ã‚Œã¦ã„ãªã„ç†ç”±ãŒã‚ã‚‹ã¯ãšã ã¨æ€ã£ãŸã‹ã‚‰ã§ã™ã€‚ ã¯ã¦ã¶ã®æ–¹ã¯è¦‹ã¦ã„ã¾ã—ãŸãŒã€æ—¥è¨˜ã®æ–¹ã‚’è¦‹è½ã¨ã—ã¦ã„ã¾ã—ã¦ã€ãŠè¿”äº‹ãŒé…ã‚Œã¾ã—ãŸ(_ _)ã€‚ ãªãœã€ã€Œ<ã€ã€ã€Œ>ã€ã€ã€Œ&ã€ã€ã€Œ"ã€ã€ã€Œ'ã€ã®5ç¨®é¡žã®æ–‡å—ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã®ã‹ã«ã¤ã„ã¦ã¯ã€è‰²ã€…è€ƒãˆã‚‹ã¨ã“ã‚ãŒã‚ã‚Šã¾ã™ã€‚
monjudoh 2007/07/04
web

xss

html

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ãƒªãƒ³ã‚¯
1