[ã‚»ã‚ュリティ]javascript://ã®XSS 00:17 - 2008-07-30 - T.Teradaã®æ—¥è¨˜ã“ã‚“ãªå ´åˆã€æ™®é€šã¯javascriptã‚„dataスã‚ームãªã©ã‚’使ã£ã¦XSSã•ã›ã‚‹ã®ã§ã—ょã†ã€‚ <a href="ã“ã“ã«HTMLエンコードã•ã‚Œã¦å…¥ã‚‹">link</a> ã—ã‹ã—ã€ã“ã®ã‚¢ãƒ—リã¯ã€Œjavascript://...ã€ã®ã‚ˆã†ã«ã€å…ˆé ã‹ã‚‰ã‚¢ãƒ«ãƒ•ã‚¡ãƒ™ãƒƒãƒˆæ•°æ–‡å—ãŒç¶šãã€ãã®ç›´å¾Œã«ã€Œ://ã€ãŒä»˜ã„ã¦ã„る値以外ã¯ã€ã‚¨ãƒ©ãƒ¼ã§ã¯ã˜ã„ã¦ã—ã¾ã„ã¾ã™ã€‚ ã“ã®ã€Œ:ã€ã®ã‚ã¨ã®ã€Œ//ã€ãŒæ›²è€…ã§ã™ã€‚ dataスã‚ーマを試ã—ã¦ã¿ã¾ã—ãŸãŒã€ã€Œ//ã€ãŒã‚ã‚‹ã¨ã©ã†ã‚„らダメらã—ã„ã¨ã„ã†ã“ã¨ã§ã€javascriptスã‚ームã§é ‘å¼µã£ã¦ã¿ã¾ã™ã€‚ ã¾ãšã¯ã“ã‚“ãªæ„Ÿã˜ã§ã™ã€‚ <a href="javascript://hoge[0x0A]alert(111)">link</a> 「//ã€ãŒè¡Œã‚³ãƒ¡ãƒ³ãƒˆã®é–‹å§‹ã«ãªã‚‹ãŸã‚ã€[0x0A]（LF）や[0x0D][0x0A]（CRLF）を入れã¦ã¿ã¦ã€ãã®å¾Œã«å‹•ã‹ã—ãŸã„JavaScriptコードを
![[ã‚»ã‚ュリティ]javascript://ã®XSS 00:17 - 2008-07-30 - T.Teradaã®æ—¥è¨˜](https://cdn-ak-scissors.b.st-hatena.com/image/square/3ce21f422dafba32f7c257ef3ed09227bfdd2c5e/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F10257846132711010800%2F10257846132711092219%2F1548045373)
{{#tags}}- {{label}}
{{/tags}}