IE8ã®XSSフィルタãŒè£ç›®ã«å‡ºã‚‹ä¾‹ - 2009-06-22 - T.Teradaã®æ—¥è¨˜IE8ã®XSSフィルタã¯ã€Webアプリã«XSS脆弱性ãŒã‚ã£ãŸã¨ã—ã¦ã‚‚ã€ãã‚ŒãŒç™ºå‹•ã™ã‚‹å¯èƒ½æ€§ã‚’減らã—ã¦ãれるもã®ã§ã™ã€‚ ã—ã‹ã—ã€ãã®XSSフィルタãŒè£ç›®ã«å‡ºã‚‹ã‚ˆã†ãªã“ã¨ã‚‚ã‚ã‚Šã¾ã™ã€‚ 例ãˆã°ã€ä»¥ä¸‹ã®ã‚ˆã†ãªé™çš„ãªHTMLファイル（test.html）を作ã£ã¦Webサーãƒã«ãŠãã¾ã™ã€‚ <h3>ie8 test</h3> <!-- 1 --> <script> var u=document.URL; </script> <!-- 2 --> <script> u=u.replace(/&/g,'&').replace(/</g,'<'); </script> <!-- 3 --> <script> document.write('URL:'+u); </script> 上ã®ãƒšãƒ¼ã‚¸ã¯é™çš„ãªãƒšãƒ¼ã‚¸ã§ã€DOM Based XSSã®è„†å¼±æ€§ã‚‚ã‚ã‚Šã¾ã›ã‚“。ã§ã™ãŒã€è¢«å®³è€…ã®ãƒ¦ãƒ¼ã‚¶ãŒIE8を使ã£ã¦ã„ã‚‹
JavaScript Hijack/JSON Hijackã®ãœã„弱性
JavaScriptスクリプトã«æ½œã‚€XSSã®ãœã„弱性も検出
[ã‚»ã‚ュリティ]javascript://ã®XSS 00:17 - 2008-07-30 - T.Teradaã®æ—¥è¨˜![[ã‚»ã‚ュリティ]javascript://ã®XSS 00:17 - 2008-07-30 - T.Teradaã®æ—¥è¨˜](https://cdn-ak-scissors.b.st-hatena.com/image/square/3ce21f422dafba32f7c257ef3ed09227bfdd2c5e/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F10257846132711010800%2F10257846132711092219%2F1548045373)
入力値検証ã®è©± - T.Teradaã®æ—¥è¨˜ - 2007-09-08
T.Teradaã®æ—¥è¨˜ HTML Purifierを試ã—ãŸ
{{#tags}}- {{label}}
{{/tags}}