[B! javascript][ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] okyawaã®ãƒ

okyawa id:okyawa

javascriptã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹okyawaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (15)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒˆãƒã‚¤ã®æœ¨é¦¬åŒ–ã—ãŸjQueryãŒGitHubã‚„CDNçµŒç”±ã§æ‹¡æ•£ã€€ç±³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼æ¥ãŒè¦å‘Š
ç±³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼æ¥ã®Phylumã¯7æœˆ3æ—¥ï¼ˆç¾åœ°æ™‚é–“ï¼‰ã€JavasScriptãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒjQueryã€ã®ç‰¹å®šãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒãƒˆãƒã‚¤ã®æœ¨é¦¬åŒ–ã•ã‚Œã€GitHubãªã©ã§æ‹¡æ•£ã—ã¦ã„ã‚‹ã¨è¦å‘Šã—ãŸã€‚ åŒç¤¾ã¯5æœˆ26æ—¥ã€ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ç®¡ç†ã‚·ã‚¹ãƒ†ãƒ ã€Œnpmã€ã§ãƒˆãƒã‚¤ã®æœ¨é¦¬åŒ–ã•ã‚ŒãŸjQueryã‚’ç¢ºèªã€‚å°‘ãªãã¨ã‚‚1ã‚«æœˆã«ã‚ãŸã£ã¦ã€æ•°åã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã§â€œæ±šæŸ“â€ã•ã‚ŒãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒå…¬é–‹ã•ã‚Œã¦ã„ã‚‹ã®ã‚’ç¢ºã‹ã‚ãŸã€‚ã•ã‚‰ã«ã€GitHubã‚„CDNã‚µãƒ¼ãƒ“ã‚¹ã€ŒjsDelivrã€ã§ã‚‚æ‹¡æ•£ã—ã¦ã„ã‚‹ã“ã¨ãŒåˆ†ã‹ã£ãŸã¨ã—ã¦ã„ã‚‹ã€‚ å¯¾è±¡ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«ã¯ã€æ‚ªæ„ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ãŒè¿½åŠ ã•ã‚ŒãŸjQueryã®ã‚³ãƒ”ãƒ¼ãŒå«ã¾ã‚Œã¦ã„ãŸã€‚æ±šæŸ“ã•ã‚ŒãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯Webã‚µã‚¤ãƒˆã®ãƒ•ã‚©ãƒ¼ãƒ ãƒ‡ãƒ¼ã‚¿ã‚’æŠ½å‡ºã—ã€å¤–éƒ¨ã«é€ä¿¡ã™ã‚‹ã¨ã„ã†ã€‚ Phylumã¯ã€Œãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚’ä½œå‹•ã•ã›ã‚‹ãŸã‚ã«å¿…è¦ãªæ¡ä»¶ã¯é™ã‚‰ã‚Œã¦ã„ã‚‹ãŒã€ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒåºƒãé…å¸ƒã•ã‚Œã¦ã„ã‚‹ã“ã¨ã‹ã‚‰ã€æ½œåœ¨çš„ãªå½±éŸ¿ã¯åºƒãã€å¤šãã®é–‹ç™ºè€…ã«å½±éŸ¿ã‚’ä¸Ž
okyawa 2024/07/10
jquery

cdn

github

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

javascript

ãƒˆãƒã‚¤ã®æœ¨é¦¬
ãƒªãƒ³ã‚¯
jQuery Attack Hits NPM and GitHub; Can Extract Web Form Data
jQuery Attack Hits NPM and GitHub; Can Extract Web Form Data The trojanized jQuery attack has been spread on npm, GitHub and elsewhere since May. A trojanized version of jQuery has been spreading on the npm JavaScript package manager, GitHub and elsewhere, for use in a jQuery attack, security researchers have discovered. Phylum researchers said they have been monitoring the â€œpersistent supply chai
okyawa 2024/07/10
jquery

cdn

malware

ãƒˆãƒã‚¤ã®æœ¨é¦¬

js

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

form
ãƒªãƒ³ã‚¯
JavaScriptãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒPolyfill.ioã€ã«ãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒæ··å…¥ã•ã‚Œ10ä¸‡ä»¥ä¸Šã®ã‚µã‚¤ãƒˆã«å½±éŸ¿
ã‚¦ã‚§ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³é–“ã®é•ã„ã‚’ç„¡åŠ¹åŒ–ã™ã‚‹JavaScriptãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒPolyfill.ioã€ãŒã€2024å¹´2æœˆã®ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‚ªãƒ¼ãƒŠãƒ¼å¤‰æ›´å¾Œã€ãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒæ··å…¥ã•ã‚Œã¦ã‚µãƒ—ãƒ©ã‚¤ãƒã‚§ãƒ¼ãƒ³æ”»æ’ƒã«åˆ©ç”¨ã•ã‚Œã€10ä¸‡ä»¥ä¸Šã®ã‚µã‚¤ãƒˆã«å½±éŸ¿ãŒå‡ºã¦ã„ã¾ã™ã€‚ Polyfill supply chain attack hits 100K+ sites https://sansec.io/research/polyfill-supply-chain-attack ã€ŒPolyfill.io(polyfill.js)ã€ã¯ã‚¢ãƒ³ãƒ‰ãƒªãƒ¥ãƒ¼ãƒ»ãƒ™ãƒƒãƒ„æ°ãŒé–‹ç™ºã—ãŸJavaScriptãƒ©ã‚¤ãƒ–ãƒ©ãƒªã§ã™ã€‚ã‚¦ã‚§ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³é–“ã§æ©Ÿèƒ½ã®é•ã„ãŒã‚ã‚‹ã¨é–‹ç™ºæ™‚ã«è‹¦åŠ´ã—ã¾ã™ãŒã€Polyfill.ioã‚’åˆ©ç”¨ã™ã‚Œã°ã€æ–°ã—ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«ã—ã‹ãªã„æ©Ÿèƒ½ã‚’å¤ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«ãªã‚‹ãŸã‚ã€ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®é•ã„ã‚’æ°—ã«ã™ã‚‹ã“ã¨ãªãé–‹ç™ºã‚’é€²ã‚ã‚‹ã“ã¨
okyawa 2024/07/01
Polyfill

ãƒ©ã‚¤ãƒ–ãƒ©ãƒª

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

js

security

ãƒžãƒ«ã‚¦ã‚§ã‚¢

ã‚µãƒ—ãƒ©ã‚¤ãƒã‚§ãƒ¼ãƒ³
ãƒªãƒ³ã‚¯
GitHubã€è„†å¼±æ€§ã®ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿéš›ã«ãƒ‡ãƒãƒƒã‚°ã—ã¦å¦ã¹ã‚‹ã€ŒSecure Code Gameã€ã‚·ãƒ¼ã‚ºãƒ³2ãŒã‚¹ã‚¿ãƒ¼ãƒˆ
GitHubã€è„†å¼±æ€§ã®ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿéš›ã«ãƒ‡ãƒãƒƒã‚°ã—ã¦å¦ã¹ã‚‹ã€ŒSecure Code Gameã€ã‚·ãƒ¼ã‚ºãƒ³2ãŒã‚¹ã‚¿ãƒ¼ãƒˆ ã€ŒSecure Code Gameã€ã¯ã€ã‚²ãƒ¼ãƒ ã¨åä»˜ã‘ã‚‰ã‚Œã¦ã„ã¾ã™ãŒã€å®Ÿéš›ã®ã‚³ãƒ¼ãƒ‰ã‚’æœˆé–“60æ™‚é–“ç„¡æ–™ã§æä¾›ã•ã‚Œã‚‹GitHub Codespacesã®æ©Ÿèƒ½ã‚’é§†ä½¿ã—ã¦ä¿®æ£ã—ã€ãƒ¦ãƒ‹ãƒƒãƒˆãƒ†ã‚¹ãƒˆã‚’é€šã—ã¦å®Œæˆã•ã›ã‚‹æ‰‹é †ã¨ãªã£ã¦ãŠã‚Šã€å®Ÿè·µã«è¿‘ã„å†…å®¹ã¨ãªã£ã¦ã„ã¾ã™ã€‚ æ˜¨å¹´ï¼ˆ2023å¹´ï¼‰3æœˆã«é–‹å§‹ã•ã‚ŒãŸã‚·ãƒ¼ã‚ºãƒ³1ã¯ã€Pythonã¨Cè¨€èªžã§ã®ã‚»ã‚ãƒ¥ã‚¢ãªã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’å¦ã¹ã‚‹å†…å®¹ã§ã—ãŸã€‚ä»Šå›žã®ã‚·ãƒ¼ã‚ºãƒ³2ã§ã¯ã“ã‚Œã‚‰ã«åŠ ãˆã¦JavaScriptã€Goã€ãã—ã¦GitHub Actionsã®Yamlãƒ•ã‚¡ã‚¤ãƒ«ãªã©ãŒå«ã¾ã‚Œã¦ãŠã‚Šã€ã“ã‚Œã‚‰ã®ã‚³ãƒ¼ãƒ‰ã®ãƒã‚°ã‚’ä¿®æ£ã™ã‚‹ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ Secure Code Gameã®å§‹ã‚æ–¹ ã€ŒSecure Code Gameã€ã®å§‹ã‚æ–¹ã¯æ¬¡ã®é€šã‚Šã§ã™ã€‚ ã¾ãšã€ŒSecure Code G
okyawa 2024/02/20
github

ãƒ‡ãƒãƒƒã‚°

ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°

game

ç„¡æ–™

JavaScript

js

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
ãªã‚“ã¨ãªã CORS ãŒã‚ã‹ã‚‹...ã¯ã‚‚ã†çµ‚ã‚ã‚Šã«ã™ã‚‹ã€‚ - Qiita
Access to XMLHttpRequest at 'http://localhost:8081' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8080' is ther
okyawa 2023/09/13
cors

ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆ

javascript

ajax

api

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆãŒJavaScriptã¨Cookieãªã—ã§å€‹äººã‚’è¿½è·¡ã™ã‚‹æ–¹æ³•ãŒä¸€ç™ºã§ç†è§£ã§ãã‚‹ã€ŒNo-JavaScript fingerprintingã€
ã€Œãƒ•ã‚£ãƒ³ã‚¬ãƒ¼ãƒ—ãƒªãƒ³ãƒˆã€ã¨ã¯ã€JavaScriptã‚„Cookieãªã—ã§ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’è˜åˆ¥ã™ã‚‹ãŸã‚ã®å›ºæœ‰è˜åˆ¥åã§ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®å±žæ€§ãƒ»è¡Œå‹•ãƒ»èˆˆå‘³ãƒ»é–¢å¿ƒã¨ã„ã£ãŸè©³ç´°ãªæƒ…å ±ã‚’ã‚‚ã¨ã«ãƒžãƒƒãƒã™ã‚‹åºƒå‘Šã‚’è¡¨ç¤ºã™ã‚‹ã‚¿ãƒ¼ã‚²ãƒ†ã‚£ãƒ³ã‚°åºƒå‘Šã«ç”¨ã„ã‚‰ã‚Œã¾ã™ã€‚ãã‚“ãªãƒ•ã‚£ãƒ³ã‚¬ãƒ¼ãƒ—ãƒªãƒ³ãƒˆãŒã€JavaScriptã‚„Cookieã‚’ä½¿ã‚ãšã«ã©ã†ã‚„ã£ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’ç‰¹å®šã—ã¦ã„ã‚‹ã®ã‹ãŒã‚ˆãã‚ã‹ã‚‹ã‚µã‚¤ãƒˆã€ŒNo-JavaScript fingerprintingã€ãŒå…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ No-JavaScript fingerprinting https://noscriptfingerprint.com/ ä»Šå›žã¯Google Chromeã‹ã‚‰No-JavaScript fingerprintingã«ã‚¢ã‚¯ã‚»ã‚¹ã—ã¦ã¿ã¾ã™ã€‚ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹å‰ã«ã€JavaScriptã‚’ä½¿ç”¨ã—ãªã„ã‚ˆã†ã«ã‚ã‚‰ã‹ã˜ã‚ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰è¨å®šã—ã¦ãŠãã¾ã™ã€‚Chromeã®å³ä¸Šã«ã‚
okyawa 2022/02/17
javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

cookie

ãƒ–ãƒ©ã‚¦ã‚¶

ã‚¯ãƒƒã‚ãƒ¼

è¿½è·¡

åºƒå‘Š

ã‚¿ãƒ¼ã‚²ãƒ†ã‚£ãƒ³ã‚°

ãƒ•ã‚£ãƒ³ã‚¬ãƒ¼ãƒ—ãƒªãƒ³ãƒˆ
ãƒªãƒ³ã‚¯
Token Storage
Key Concepts How you decide to store your token is crucial to defending your application against malicious attacks. Review scenarios for each application type. Decide which method best supports your techno logy. Securing SPAs that make API calls come with their own set of concerns. You'll need to ensure that tokens and other sensitive data are not vulnerable to cross-site scripting (XSS) and can't
okyawa 2019/10/10
session

localstorage

cookie

OAuth

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

jwt
ãƒªãƒ³ã‚¯
HTML5ã®Local Storageã‚’ä½¿ã£ã¦ã¯ã„ã‘ãªã„ï¼ˆç¿»è¨³ï¼‰ï½œTechRacho by BPSæ ªå¼ä¼šç¤¾
æ¦‚è¦ åŽŸè‘—è€…ã®è¨±è«¾ã‚’å¾—ã¦ç¿»è¨³ãƒ»å…¬é–‹ã„ãŸã—ã¾ã™ã€‚ è‹±èªžè¨˜äº‹: Randall Degges - Please Stop Using Local Storage åŽŸæ–‡å…¬é–‹æ—¥: 2018/01/26 è‘—è€…: Randall Degges æ—¥æœ¬èªžã‚¿ã‚¤ãƒˆãƒ«ã¯å†…å®¹ã«å³ã—ãŸã‚‚ã®ã«ã—ã¾ã—ãŸã€‚ ç”»åƒã¯å…ƒè¨˜äº‹ã‹ã‚‰ã®å¼•ç”¨ã§ã™ã€‚ åˆç‰ˆå…¬é–‹: 2019/10/19 è¿½è¨˜æ›´æ–°: 2024/04/05 -- ãƒªãƒ³ã‚¯æƒ…å ±ã‚’è¨˜äº‹æœ«å°¾ã«ç§»å‹•ã—ã¾ã—ãŸ æœ¬æ°—ã§ç”³ã—ä¸Šã’ã¾ã™ã€‚local storageã‚’ä½¿ã‚ãªã„ã§ãã ã•ã„ã€‚ local storageã«ã‚»ãƒƒã‚·ãƒ§ãƒ³æƒ…å ±ã‚’ä¿å˜ã™ã‚‹é–‹ç™ºè€…ãŒã“ã‚Œã»ã©å¤šã„ç†ç”±ã«ã¤ã„ã¦ã€ç§ã«ã¯ã•ã£ã±ã‚Šè¦‹å½“ãŒã¤ãã¾ã›ã‚“ã€‚ã—ã‹ã—ã©ã‚“ãªç†ç”±ã§ã‚ã‚Œã€ãã®æ‰‹æ³•ã¯åœ°ä¸Šã‹ã‚‰æ¶ˆãˆã¦ãªããªã£ã¦ã‚‚ã‚‰ã†å¿…è¦ãŒã‚ã‚Šã¾ã™ãŒã€æ˜Žã‚‰ã‹ã«æ‰‹ã«è² ãˆãªããªã‚Šã¤ã¤ã‚ã‚Šã¾ã™ã€‚ ç§ã¯æ¯Žæ—¥ã®ã‚ˆã†ã«ã€é‡è¦ãªãƒ¦ãƒ¼ã‚¶ãƒ¼æƒ…å ±ã‚’local storageã«ä¿å˜ã™
okyawa 2019/10/10
ãƒ–ãƒ©ã‚¦ã‚¶

cookie

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

localstorage

web

javascript

IndexDB
ãƒªãƒ³ã‚¯
@â€XSS (ä¸€éƒ¨ã®ãƒ–ãƒ©ã‚¦ã‚¶ã®location.hrefãŒXSSã‚’å¼•ãèµ·ã“ã—ã‚„ã™ã„ã“ã¨ã«é–¢ã™ã‚‹æ³¨æ„å–šèµ·)
@â€XSS (ä¸€éƒ¨ã®ãƒ–ãƒ©ã‚¦ã‚¶ã®location.hrefãŒXSSã‚’å¼•ãèµ·ã“ã—ã‚„ã™ã„ã“ã¨ã«é–¢ã™ã‚‹æ³¨æ„å–šèµ·) æ¦‚è¦ ä¸€éƒ¨ã®ãƒ–ãƒ©ã‚¦ã‚¶ã®location.hrefã¯ã€XSSãªã©ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã‚’å¼•ãèµ·ã“ã—ã‚„ã™ã„å€¤ã‚’è¿”ã—ã¾ã™ã€‚ã“ã®æŒ™å‹•ã«ã‚ˆã‚Šã€location.hrefãŒè‡ªåˆ†ã¨åŒã˜ãƒ‰ãƒ¡ã‚¤ãƒ³ã®URLã‚’è¿”ã™ã“ã¨ã‚’å‰æã«æ›¸ã„ã¦ã„ã‚‹ã‚³ãƒ¼ãƒ‰ã¯å…¨ã¦ã€æ£ã—ãå‹•ã‹ãªããªã‚‹æã‚ŒãŒã‚ã‚Šã¾ã™ã€‚ å½±éŸ¿ã‚’å—ã‘ã‚‹ãƒ–ãƒ©ã‚¦ã‚¶ Safari 6æœªæº€(Windowsã¯ä¿®æ£ç‰ˆãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã¾ã›ã‚“) iOS 6.0æœªæº€ã®Safari Mobile Android4.1æœªæº€?ã®æ¨™æº–ãƒ–ãƒ©ã‚¦ã‚¶(Android 2.3.6ã§ãƒ†ã‚¹ãƒˆã—ã¾ã—ãŸã€‚@bulkneetsã•ã‚“ã«ã‚ˆã‚‹ã¨4.1ã¯ä¿®æ£æ¸ˆã¿ã€4.0.3ã¯å½±éŸ¿ã‚’å—ã‘ã‚‹ã¨ã®ã“ã¨ã§ã™ã€‚@cubedlã•ã‚“ã«ã‚ˆã‚‹ã¨4.0.4ã¯å½±éŸ¿ã‚’å—ã‘ã‚‹ã¨ã®ã“ã¨ã§ã™ã€‚) æŒ™å‹•ã®å†ç¾ 1. http://l0.cm/atx
okyawa 2012/08/04
xss

JavaScript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

safari

security
ãƒªãƒ³ã‚¯
ç§ã¯ã„ã‹ã«ã—ã¦ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ç«¯æœ«60æ©Ÿç¨®ã®JavaScriptã‚’æ¤œè¨¼ã—ãŸã‹ - ockeghem's blog
æ˜¨æ—¥ã®ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ã®éžå…¬å¼JavaScriptå¯¾å¿œã®èª¿æŸ»çµæžœ | å¾³ä¸¸æµ©ã®æ—¥è¨˜ã§å ±å‘Šã—ãŸã‚ˆã†ã«ã€æ˜¨å¹´5æœˆã«ã€ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯60æ©Ÿç¨®ã®æ¤œè¨¼ã‚’è¡Œã„ã€JavaScriptå¯¾å¿œã®çŠ¶æ³ãªã©ã‚’èª¿æŸ»ã—ã¾ã—ãŸã€‚å½“æ™‚ã¯ã¾ã å…¬å¼ãªJavaScriptå¯¾å¿œæ©Ÿç¨®ã¯ãªã„çŠ¶æ…‹ã§ã—ãŸãŒã€æ—¢ã«ã»ã¨ã‚“ã©ã®ç«¯æœ«ãŒ *éžå…¬å¼ã«* JavaScriptã«å¯¾å¿œã—ã¦ã„ã¾ã—ãŸã€‚ ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€æ¤œè¨¼ã®æ§˜åã‚’å ±å‘Šã—ã¾ã™ã€‚ ãªãœJavaScriptå¯¾å¿œçŠ¶æ³ã‚’èª¿æŸ»ã—ãŸã‹ http://www.hash-c.co.jp/info/20091124.htmlã‚’å…¬è¡¨ã—ãŸå‰å¾Œã«ã€ã¨ã‚ã‚‹æ–¹ï¼ˆã“ã®æ–¹ï¼‰ã‹ã‚‰ã€ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ã®ã‚±ãƒ¼ã‚¿ã‚¤ã§ã‚‚JavaScriptãŒå‹•ä½œã™ã‚‹ã¨ä¼ºã„ã¾ã—ãŸï¼ˆå‚è€ƒã®ã‚„ã‚Šã¨ã‚Šï¼‰ã€‚XMLHttpRequestã‚‚å«ã‚ã¦JavaScrptãŒå‹•ãã¨æ•™ãˆã¦ã„ãŸã ã„ãŸ932SHã‚’ç§ã‚‚è³¼å…¥ã—ã¦èª¿ã¹ãŸã¨ã“ã‚ã€ä»¥ä¸‹ãŒåˆ¤æ˜Žã—ã¾ã—ãŸã€‚ ç¢ºã‹ã«JavaScrip
okyawa 2011/07/07
ã‚±ãƒ¼ã‚¿ã‚¤

ãƒ¢ãƒã‚¤ãƒ«

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

softbank
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
okyawa 2011/06/26
jquery

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

JavaScript

xss
ãƒªãƒ³ã‚¯
XSSã®æ”»æ’ƒæ‰‹æ³•ã„ã‚ã„ã‚ - ã†ãªã®æ—¥è¨˜
html5securityã®ã‚µã‚¤ãƒˆã«ã€XSSã®å„ç¨®æ”»æ’ƒæ‰‹æ³•ãŒã¾ã¨ã‚ã‚‰ã‚Œã¦ã„ã‚‹ã®ã‚’ç™ºè¦‹ã›ã‚Š!ã¨ã„ã†ã“ã¨ã§ã€å€‹äººçš„ã«ã€ŒãŠ!ã€ã¨æ€ã£ãŸæ”»æ’ƒã‚’ã‚µãƒ³ãƒ—ãƒ«ã¤ãã§ã”ç´¹ä»‹ã—ã¾ã™ã€‚ 1. CSS Expression IE7ä»¥å‰ã«ã¯ã€ŒCSS Expressionsã€ã¨ã„ã†æ‹¡å¼µæ©Ÿèƒ½ãŒã‚ã‚Šã€CSSå†…ã§JavaScriptã‚’å®Ÿè¡Œã§ããŸã‚Šã—ã¾ã™ã€‚ <div style="color:expression(alert('XSS'));">a</div> ç¢ºèª @IT -ï¼»æŸ”è»Ÿã™ãŽã‚‹ï¼½IEã®CSSè§£é‡ˆã§èµ·ã“ã‚‹XSS ã§è©³ã—ãè§£èª¬ã•ã‚Œã¦ã„ã¾ã™ãŒã€CSSã®è§£é‡ˆãŒæŸ”è»Ÿãªã“ã¨ã¨ã‚‚ã‚ã„ã¾ã£ã¦è‡ªå‰ã§ç„¡å®³åŒ–ã™ã‚‹ã®ã¯ãªã‹ãªã‹å›°é›£ã€‚ä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã§ã‚‚ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã¦ã—ã¾ã„ã¾ã™ã€‚ <div style="color:expr/* ã‚³ãƒ¡ãƒ³ãƒˆã®æŒ¿å…¥ */ession(alert('XSS'));">a</div> ç¢ºèª <div s
okyawa 2010/06/20
javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ± - iãƒ¢ãƒ¼ãƒ‰IDã‚’ç”¨ã„ãŸã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ã®DNS Rebindingè„†å¼±æ€§
iãƒ¢ãƒ¼ãƒ‰IDã‚’ç”¨ã„ãŸã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ã®DNS Rebindingè„†å¼±æ€§ HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾ å…¬é–‹æ—¥:2009å¹´11æœˆ24æ—¥ æ¦‚è¦ iãƒ¢ãƒ¼ãƒ‰ãƒ–ãƒ©ã‚¦ã‚¶2.0ã®JavaScriptã¨DNS Rebindingå•é¡Œã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚Šã€iãƒ¢ãƒ¼ãƒ‰IDã‚’åˆ©ç”¨ã—ãŸèªè¨¼æ©Ÿèƒ½ï¼ˆä»¥ä¸‹ã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ï¼‰ã«å¯¾ã™ã‚‹ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ãŒå¯èƒ½ã¨ãªã‚‹å ´åˆãŒã‚ã‚‹ã“ã¨ã‚’ç¢ºèªã—ãŸã®ã§å ±å‘Šã™ã‚‹ã€‚å±é™ºåº¦ã®é«˜ã„æ”»æ’ƒæ‰‹æ³•ã§ã‚ã‚‹ã®ã§ã€ã‚µã‚¤ãƒˆé‹å–¶è€…ã«ã¯è‡³æ€¥ã®å¯¾ç–ã‚’æŽ¨å¥¨ã™ã‚‹ã€‚ èƒŒæ™¯æºå¸¯é›»è©±ã®ã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã¨ã¯ã€ã‚±ãƒ¼ã‚¿ã‚¤ãƒ–ãƒ©ã‚¦ã‚¶ï¼ˆãŸã¨ãˆã°iãƒ¢ãƒ¼ãƒ‰ãƒ–ãƒ©ã‚¦ã‚¶ï¼‰ã«ç”¨æ„ã•ã‚ŒãŸå¥‘ç´„è€…å›ºæœ‰IDã‚’åˆ©ç”¨ã—ãŸç°¡æ˜“çš„ãªèªè¨¼ã§ã‚ã‚Šã€ãƒ¦ãƒ¼ã‚¶ãŒIDã‚„ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å…¥åŠ›ã—ãªãã¦ã‚‚èªè¨¼ãŒå¯èƒ½ã¨ãªã‚‹ã€‚iãƒ¢ãƒ¼ãƒ‰IDã¯ã€NTTãƒ‰ã‚³ãƒ¢ã®æä¾›ã™ã‚‹å¥‘ç´„è€…å›ºæœ‰IDã®ä¸€ç¨®ã§ã€URLã«guid=ONã¨ã„ã†ã‚¯ã‚¨ãƒªã‚¹ãƒˆãƒªãƒ³ã‚°ã‚’å«ã‚ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€ç«¯æœ«å›ºæœ‰ã®7æ¡ã®IDãŒWebã‚µãƒ¼ãƒã«é€
okyawa 2010/01/14
DNSãƒªãƒã‚¤ãƒ³ãƒ‡ã‚£ãƒ³ã‚°

DNS

javascript

æºå¸¯

ã‚±ãƒ¼ã‚¿ã‚¤

mobile

docomo

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

imode
ãƒªãƒ³ã‚¯
iãƒ¢ãƒ¼ãƒ‰ãƒ–ãƒ©ã‚¦ã‚¶2.0ã®ã€Œã‹ã‚“ãŸã‚“èªè¨¼ã€ã‚’åˆ©ç”¨ã—ãŸä¸æ£ã‚¢ã‚¯ã‚»ã‚¹æ‰‹æ³•ãŒç™ºè¦‹ã•ã‚Œã‚‹:ãƒ‹ãƒ¥ãƒ¼ã‚¹ - CNET Japan
HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°ã¯11æœˆ24æ—¥ã€NTTãƒ‰ã‚³ãƒ¢ã®iãƒ¢ãƒ¼ãƒ‰IDã‚’åˆ©ç”¨ã—ãŸèªè¨¼æ©Ÿèƒ½ï¼ˆã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ï¼‰ã«ã¤ã„ã¦ã€ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ãŒå¯èƒ½ã¨ãªã‚‹å ´åˆãŒã‚ã‚‹ã¨ç™ºè¡¨ã—ãŸã€‚iãƒ¢ãƒ¼ãƒ‰ãƒ–ãƒ©ã‚¦ã‚¶2.0ã®JavaScriptã¨DNSãƒªãƒã‚¤ãƒ³ãƒ‡ã‚£ãƒ³ã‚°å•é¡Œã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚Šå®Ÿç¾ã™ã‚‹ã€‚åŒç¤¾ã§ã¯ãƒ¢ãƒã‚¤ãƒ«ã‚µã‚¤ãƒˆé‹å–¶è€…ã«å¯¾ã—ã¦è‡³æ€¥å¯¾ç–ã‚’å–ã‚‹ã‚ˆã†å‘¼ã³ã‹ã‘ã¦ã„ã‚‹ã€‚ ã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã¨ã¯ã€å¥‘ç´„è€…ã®å›ºæœ‰IDã‚’åˆ©ç”¨ã—ãŸç°¡æ˜“èªè¨¼æ©Ÿèƒ½ã€‚ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒIDã‚„ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å…¥åŠ›ã—ãªãã¦ã‚‚èªè¨¼ãŒã§ãã‚‹ã“ã¨ã‹ã‚‰ã€ãƒ¢ãƒã‚¤ãƒ«ã‚µã‚¤ãƒˆã§ã¯åºƒãæŽ¡ç”¨ã•ã‚Œã¦ã„ã‚‹ã€‚NTTãƒ‰ã‚³ãƒ¢ã®å ´åˆã¯iãƒ¢ãƒ¼ãƒ‰IDã¨å‘¼ã°ã‚Œã‚‹ç«¯æœ«å›ºæœ‰ã®7ã‚±ã‚¿ã®ç•ªå·ã‚’ä½¿ã£ã¦ã„ã‚‹ã€‚ NTTãƒ‰ã‚³ãƒ¢ã§ã¯2009å¹´5æœˆä»¥é™ã«ç™ºå£²ã—ãŸç«¯æœ«ã«ãŠã„ã¦ã€JavaScriptãªã©ã«å¯¾å¿œã—ãŸã€Œiãƒ¢ãƒ¼ãƒ‰ãƒ–ãƒ©ã‚¦ã‚¶2.0ã€ã¨å‘¼ã°ã‚Œã‚‹æ–°ãƒ–ãƒ©ã‚¦ã‚¶ã‚’æŽ¡ç”¨ã€‚10æœˆæœ«ã‹ã‚‰JavaScriptãŒåˆ©ç”¨å¯èƒ½ã¨ãªã£ã¦ã„ã‚‹ã€‚ã¾ãŸã€DNSãƒªãƒã‚¤ãƒ³ãƒ‡
okyawa 2010/01/14
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

mobile

æºå¸¯

DoCoMo

DNS

javascript
ãƒªãƒ³ã‚¯
ä¸»è¦ãƒ–ãƒ©ã‚¦ã‚¶ã™ã¹ã¦ã«å½±éŸ¿ã™ã‚‹ã€Œã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ã€æ”»æ’ƒã¨ã¯
Windows SQL Server 2005ã‚µãƒãƒ¼ãƒˆçµ‚äº†ã®4æœˆ12æ—¥ãŒè¿«ã‚‹ã€å ±å‘Šæ¸ˆã¿è„†å¼±æ€§ã®æ·±åˆ»åº¦ã‚‚é«˜ãã€æ—©æ€¥ãªç§»è¡Œã‚’
okyawa 2009/03/06
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

ãƒ–ãƒ©ã‚¦ã‚¶

ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°
ãƒªãƒ³ã‚¯
1