[B! ie][security] shimookaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

shimooka id:shimooka

ieã¨securityã«é–¢ã™ã‚‹shimookaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (15)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ï¼©ï¼¥ä¸å…·åˆã€ç±³ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆãŒï¼¸ï¼°ã«ã‚‚ä¿®æ£ç‰ˆæä¾›
ï¼•æœˆï¼‘æ—¥ã€ï¼©ï¼¥ä¸å…·åˆå•é¡Œã§ã€ç±³ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆã¯ï¼¸ï¼°ã«ã¤ã„ã¦ã‚‚ç·Šæ€¥ã®æ”¹å–„ç–ã‚’æä¾›ã™ã‚‹ã¨æ˜Žã‚‰ã‹ã«ã—ãŸã€‚å†™çœŸã¯åŒç¤¾ã®ãƒã‚´ã€‚ï¼”æœˆæ’®å½±ï¼ˆï¼’ï¼ï¼‘ï¼”å¹´ã€€ãƒã‚¤ã‚¿ãƒ¼ï¼Mikko Stig/Lehtikuvaï¼‰ ï¼»ãƒœã‚¹ãƒˆãƒ³ã€€ï¼‘æ—¥ã€€ãƒã‚¤ã‚¿ãƒ¼ï¼½ - ç±³ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆé–²è¦§ã‚½ãƒ•ãƒˆã€Œã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒ»ã‚¨ã‚¯ã‚¹ãƒ—ãƒãƒ¼ãƒ©ãƒ¼ï¼ˆï¼©ï¼¥ï¼‰ã€ã«ãƒãƒƒã‚«ãƒ¼æ”»æ’ƒã«å¯¾ã™ã‚‹è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸå•é¡Œã§ã€åŒç¤¾ã¯ã™ã§ã«é¡§å®¢ã‚µãƒãƒ¼ãƒˆã‚’çµ‚äº†ã—ã¦ã„ãŸåŸºæœ¬ã‚½ãƒ•ãƒˆï¼ˆï¼¯ï¼³ï¼‰ã€Œã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã‚ºï¼¸ï¼°ã€ã«ã¤ã„ã¦ã‚‚ç·Šæ€¥ã®æ”¹å–„ç–ã‚’æä¾›ã™ã‚‹ã¨æ˜Žã‚‰ã‹ã«ã—ãŸã€‚
shimooka 2014/05/02
microsoft

ie

security
ãƒªãƒ³ã‚¯
æ·±åˆ»ãªè„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸInternet Explorerï¼ˆIE6ï½ž11ï¼‰ã‚’å·¡ã‚Šå…¨å›½å„åœ°ã®ç¤¾å†…ãŒã‚³ãƒ³ãƒˆã§ã‚«ã‚ªã‚¹ : å¸‚æ³ã‹ã¶å…¨åŠ›ï¼’éšŽå»º
ãƒ›ãƒãƒ©ã‚¤ãƒ–ã®ã‚«ãƒãƒ¼ã€æ²™èŠ±å‰ã‚¯ãƒãƒ±ã•ã‚“é…ä¿¡æ´»å‹•çµ‚äº†(ã‚ãƒ£ãƒ©ã‚¯ã‚¿ãƒ¼æ¶ˆæ»…ã¯å›žé¿)ã§ã‚¯ãƒ“å’æ¥åˆã‚ã›ã¦ä»Šå¹´5äººç›®ã®ãŠåˆ¥ã‚Œè¡¨æ˜Ž
shimooka 2014/05/01
ie

security

neta
ãƒªãƒ³ã‚¯
æ—¥æœ¬ã®çœåºãªã©ã¸â€œæ°´é£²ã¿å ´åž‹æ”»æ’ƒâ€ã€IEã®ã‚¼ãƒãƒ‡ã‚¤ã‚’çªãã€8æœˆã«èµ·ãã¦ã„ãŸã€€
shimooka 2013/10/10
ã€Žæ°´é£²ã¿å ´åž‹æ”»æ’ƒã€

security

ie
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§cookieæ›¸ãè¾¼ã‚€æ–¹æ³• +ã‚¯ãƒã‚¹ãƒ–ãƒ©ã‚¦ã‚¶ã§ - webãƒã‚¿
ã‚ã‚‹ã‚µã‚¤ãƒˆã‹ã‚‰åˆ¥ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ã‚¯ãƒƒã‚ãƒ¼ã‚’æ›¸ãè¾¼ã‚€ã€‚ã“ã†ã„ã†ã‚¯ãƒƒã‚ãƒ¼ã¯ã€ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ã‚¯ãƒƒã‚ãƒ¼ã¨å‘¼ã°ã‚Œã‚‹ã€‚Firefoxã¨Chromeã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ã‚¯ãƒƒã‚ãƒ¼ãŒæ›¸ãè¾¼ã‚ã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ãŒã€IEã¨SafariãŒå•é¡Œã«ãªã‚‹ã€‚IEã¯ã‚³ãƒ³ãƒ‘ã‚¯ãƒˆãƒãƒªã‚·ãƒ¼ã¨ã„ã†ã‚‚ã®ã‚’è¨å®šã™ã‚Œã°ã„ã‘ã‚‹ãŒã€Safariã¯å‡ºæ¥ãªã„ã€‚Safariã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§â€çŸ¥ã‚‰ãªã„ã¨ã‚µã‚¤ãƒˆã‚„åºƒå‘Šã®ã¿Cookieã‚’ãƒ–ãƒãƒƒã‚¯â€ã¨ãªã£ã¦ã„ã‚‹ã€‚ã§ã‚‚ã€Google Adsenseã¨ã‹ã¯æ›¸ãè¾¼ã‚ã¦ã„ã‚‹ã€‚ãªã®ã§èª¿ã¹ãŸã€‚ ç›®çš„ localhostã«ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸã¨ãsample.comã®ã‚¯ãƒƒã‚ãƒ¼ã‚’æ›¸ãè¾¼ã¿ãŸã„ã€‚ ã‚‚ã¡ã‚ã‚“ã‚¯ãƒã‚¹ãƒ–ãƒ©ã‚¦ã‚¶ã§ã€‚ (sample.comã¯hostsæ›¸ãæ›ãˆã‚„ã‚‹ã¨ã„ã„) ãƒãƒªã‚·ãƒ¼ã®è¨å®š (P3P) (ä»¥ä¸‹IEå¯¾ç–ç”¨) webã‚µã‚¤ãƒˆã§å€‹äººæƒ…å ±ãªã©ã‚’å–ã‚Šæ‰±ã†å ´åˆã€ãƒ–ãƒ©ã‚¦ã‚¶ã§è¨å®šã•ã‚ŒãŸãƒãƒªã‚·ãƒ¼è¨å®šã¨ã‚¢ã‚¯ã‚»ã‚¹ã—ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã®ãƒãƒªã‚·ãƒ¼
shimooka 2012/01/12
ã€Žiframeã®ä¸ã«formé€ä¿¡ã™ã‚‹ã¨ã€ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ã‚¯ãƒƒã‚ãƒ¼ã‚‚æ›¸ãè¾¼ã‚ã‚‹ã€ãªã‚“ã€‚ã€‚ã€‚ã ã¨

safari

cookie

security

ie
ãƒªãƒ³ã‚¯
X-Content-Type-Options: nosniff ã¤ã‹ã‚ãªã„ã‚„ã¤ã¯æ»ãã°ã„ã„ã®ã«! - è‘‰ã£ã±æ—¥è¨˜
2011-01-06: IE8ã¨ã„ã†ã“ã¨ã‚’è¿½è¨˜ & ã¡ã‚‡ã£ã¨é–“é•ã„ã‚’ä¿®æ£ã€‚ã‚ã‘ã¾ã—ã¦ãŠã‚ã§ã¨ã†ã”ã–ã„ã¾ã™ã€‚ å¹´æ˜Žã‘æ—©ã€…ã§ã™ãŒã€Internet Explorerã®è©±é¡Œã§ã™ã€‚IEã¯ã”å˜ã˜ã®é€šã‚Šã€Content-Type ã ã‘ã§ãªãã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®å†…å®¹ãªã©ã‚‚ sniff ã™ã‚‹ã“ã¨ã§ãƒ•ã‚¡ã‚¤ãƒ«ã‚¿ã‚¤ãƒ—ã‚’æ±ºå®šã—ã¦ã„ã‚‹ãŸã‚ã€ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã‚„ãƒ†ã‚ã‚¹ãƒˆãƒ•ã‚¡ã‚¤ãƒ«ã‚’HTMLã¨åˆ¤å®šã—ã¦ã—ã¾ã„ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ãŒç™ºç”Ÿã™ã‚‹ã“ã¨ãŒæ˜”ã‹ã‚‰ãŸã³ãŸã³å ±å‘Šã•ã‚Œã¦ã„ã¾ã—ãŸ*1ã€‚ç¾åœ¨ã¯å¹¾åˆ†ãƒžã‚·ã«ãªã£ãŸã¨ã¯ã„ãˆã€IEã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚¿ã‚¤ãƒ—ã®åˆ¤å®šã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã¯éžå¸¸ã«é›£è§£ã§ã‚ã‚Šã€ç¾åœ¨ã§ã‚‚çŠ¶æ³ã«ã‚ˆã£ã¦ã¯Webã‚µã‚¤ãƒˆé‹å–¶è€…ã®ã¾ã£ãŸãæ„å›³ã—ã¦ã„ãªã„ã‹ãŸã¡ã§ã®XSSãŒç™ºç”Ÿã™ã‚‹å¯èƒ½æ€§ãŒã‚ã£ãŸã‚Šã—ã¾ã™ã€‚ãã†ã„ã†ã‚ã‘ã§ã€IEãŒã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ sniff ã—ã¦HTMLä»¥å¤–ã®ã‚‚ã®ã‚’HTMLæ‰±ã„ã—ã¦ã—ã¾ã†ã“ã¨ã‚’é˜²ããŸã‚ã«ã€å‹•çš„ã«ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ç”Ÿæˆã—ã¦ã„ã‚‹å ´åˆã«
shimooka 2011/01/06
ã€ŽX-Content-Type-Options: nosniffã€

security

ie

microsoft

browser
ãƒªãƒ³ã‚¯
ï¼»ç„¡è¦–ã§ããªã„ï¼½IEã®Content-Typeç„¡è¦–
ï¼»ç„¡è¦–ã§ããªã„ï¼½IEã®Content-Typeç„¡è¦–ï¼šæ•™ç§‘æ›¸ã«è¼‰ã‚‰ãªã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼ˆ2ï¼‰ï¼ˆ1/2 ãƒšãƒ¼ã‚¸ï¼‰ XSSã«CSRFã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«â€¦â€¦Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãƒ—ãƒã‚°ãƒ©ãƒžãŒçŸ¥ã£ã¦ãŠãã¹ãè„†å¼±æ€§ã¯ã„ã£ã±ã„ã‚ã‚Šã¾ã™ã€‚ãã“ã§æœ¬é€£è¼‰ã§ã¯ã€ãã®ã‚ˆã†ãªãƒ¡ã‚¸ãƒ£ãƒ¼ãªã‚‚ã®â€œä»¥å¤–â€ã‚‚æŽ˜ã‚Šä¸‹ã’ã¦ã„ãã¾ã™ï¼ˆç·¨é›†éƒ¨ï¼‰ ç„¡è¦–ã§ããªã„IEã®ã€ŒContent-Typeç„¡è¦–ã€å•é¡Œ çš†ã•ã‚“ã“ã‚“ã«ã¡ã¯ã€ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ã§ã™ã€‚ ç¬¬2å›žã§ã¯ã€Internet Explorerï¼ˆä»¥ä¸‹ã€IEï¼‰ã®ä»•æ§˜ã§ã‚‚ç‰¹ã«æ‚ªåé«˜ã„ã€ŒContent-Typeç„¡è¦–ã€ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ IEã®Content-Typeç„¡è¦–å•é¡Œã¯éžå¸¸ã«è¤‡é›‘ã§ã€ç§è‡ªèº«ã‚‚å®Œå…¨ã«èª¬æ˜Žã§ãã‚‹è‡ªä¿¡ã¯ãªã„ã®ã§ã™ãŒã€ãã‚Œã§ã‚‚ã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã™ã‚‹ã†ãˆã§é¿ã‘ã¦ã¯é€šã‚Œãªã„å•é¡Œã§ã™ã®ã§ã€å–ã‚Šä¸Šã’ã‚‹ã“ã¨ã«ã—ã¾ã—ãŸã€‚
shimooka 2011/01/06
ã€ŽX-Content-Type-Options: nosniffã€

security

browser

microsoft

ie
ãƒªãƒ³ã‚¯
ãƒ¢ã‚¸ãƒ©ã€Firefox 3.6.9ã¨3.5.12ã§è„†å¼±æ€§ã‚’ä¿®æ£--ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°å¯¾ç–ã‚‚è¿½åŠ - CNET Japan
shimooka 2010/09/09
firefox

security

http

browser

ie
ãƒªãƒ³ã‚¯
P3Pã‚³ãƒ³ãƒ‘ã‚¯ãƒˆãƒãƒªã‚·ãƒ¼ã‚’ã‚³ãƒ”ãƒšã™ã‚‹ã®ãŒæµè¡Œã‚‰ãªã„ã“ã¨ã‚’ç¥ˆã‚‹ | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
ãªã«ã’ã«ã—ã‚‰ãªã‹ã£ãŸã‚“ã ã‘ã©ã€IEã§åˆ¥ãƒ‰ãƒ¡ã‚¤ãƒ³ã®iframeã‚’èªã¿è¾¼ã‚€ã¨ã€ãã®iframeå†…ã®cookieãŒæœ‰åŠ¹ã«ãªã‚‰ãªã„ã€‚ ããƒ¼ã‚†ãƒ¼ã¨ãã¯ã€HTTPã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆæ™‚ã®ãƒ˜ãƒƒãƒ€ãƒ¼ã«ä¸‹è¨˜ã®keyï¼†valueã‚’å‡ºåŠ›ã—ã¦ãŠã‘ã°OKã‚‰ã—ã„ã€‚ ("P3P", 'CP="CAO PSA OUR"') ã“ãƒ¼ã™ã‚‹ã ã‘ã§ã€ã‚ã‚‰ãµã—ãŽã€‚IEãŒCookieã‚’ä¿å˜ã—ã¦ãã‚Œã‚‹ã˜ã‚ƒã‚“ã€‚ â€¦â€¦ã€‚ iframeã§åˆ¥ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’èªã¿è¾¼ã‚€ã¨ã€ãã®Cookieã¯ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ãƒ¼ã®Cookieã¨ãªã‚Šã¾ã™ã€‚IEã®ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã¯ã€ãƒãƒªã‚·ãƒ¼ãŒå®šç¾©ã•ã‚Œã¦ã„ãªã„ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ãƒ¼ã®Cookieã¯å—ã‘å…¥ã‚Œãªã„ã‚ˆã†ã«ãªã£ã¦ã„ã¦ã€P3P (www.w3.org)ã§ãƒãƒªã‚·ãƒ¼ã‚’å®£è¨€ã™ã‚Œã°å—ã‘å…¥ã‚Œã‚‰ã‚Œã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ P3Pã®ãƒãƒªã‚·ãƒ¼ã‚’å®šç¾©ã™ã‚‹ã«ã¯ã€ãŒã£ã¤ã‚Šã¨XMLã‚’ç”¨æ„ã™ã‚‹æ–¹æ³•ã‚‚ã‚ã‚Šã¾ã™ãŒã€HTTPå¿œç”ãƒ˜ãƒƒãƒ€ã®ä¸ã«ç›´æŽ¥æ›¸ãã¨ã„ã†æ–¹æ³•ã‚‚ã‚ã‚Šã€ã‚³
shimooka 2009/10/21
cookie

ie

security
ãƒªãƒ³ã‚¯
ç¬¬5å›žã€€ä¸æ£ãªãƒã‚¤ãƒˆåˆ—ã®åŸ‹ã‚è¾¼ã¿ | gihyo.jp
ä»Šå›žã¯ã€ã€Œâ ä¸æ£ãªãƒã‚¤ãƒˆåˆ—ã®åŸ‹ã‚è¾¼ã¿ã€ã¨ã„ã†æ”»æ’ƒæ–¹æ³•ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ æ–‡å—åˆ—ã‚’å…¥åŠ›ã¨ã™ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã«ã¯ã•ã¾ã–ã¾ãªã‚‚ã®ãŒã‚ã‚Šã¾ã™ãŒã€ãã‚Œã‚‰ã®å‡¦ç†ç³»ã«ã‚ˆã£ã¦ã¯ã€å…¥åŠ›ã¨ã—ã¦ä¸ŽãˆãŸæ–‡å—åˆ—ä¸ã«ã€ãã®æ–‡å—ã‚³ãƒ¼ãƒ‰ä¸Šã¯ä¸æ£ã¨ãªã‚‹ã‚ˆã†ãªãƒã‚¤ãƒˆåˆ—ã‚’åŸ‹ã‚è¾¼ã‚“ã§ã„ãŸã¨ãã«ã€ãã‚Œã‚‰ã®ãƒã‚¤ãƒˆåˆ—ãŒç„¡è¦–ã•ã‚ŒãŸã‚Šã€æƒ³å®šå¤–ã®æ–‡å—ã«å¤‰æ›ã•ã‚Œã¦ã—ã¾ã†ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ ãŸã¨ãˆã°ã€ã¨ã‚ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã«ã¦ ï¼ˆ1) å‡¦ç†A ï¼ æ–‡å—åˆ—ä¸ã«ç‰¹å®šã®æ–‡å—ï¼ˆã‚ã‚‹ã„ã¯æ–‡å—åˆ—ï¼‰ãŒå«ã¾ã‚Œã¦ã„ãªã„ã‹æ¤œæŸ» ï¼ˆ2) å‡¦ç†B ï¼ å‡¦ç†Aã‹ã‚‰å—ã‘å–ã£ãŸãƒ‡ãƒ¼ã‚¿ã‚’å‡¦ç†ã€‚ãã®éš›ã«ä¸æ£ãªãƒã‚¤ãƒˆåˆ—ãŒç„¡è¦–ã‚ã‚‹ã„ã¯åˆ¥ã®æ–‡å—ã«å¤‰æ›ã•ã‚Œã‚‹ ã¨ã„ã†æµã‚Œã«ãªã£ã¦ã„ãŸå ´åˆã€å¾Œç¶šã®å‡¦ç†ã«ã¦æœ¬æ¥ã¯ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ã•ã‚Œã‚‹ã¹ãæ–‡å—åˆ—ãŒå«ã¾ã‚Œã¦ã—ã¾ã†ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ ã“ã®ã‚ˆã†ãªæµã‚Œã‚’å¼•ãèµ·ã“ã™å…·ä½“çš„ãªä¾‹ã‚’ã„ãã¤ã‹ç´¹ä»‹ã—ã¾ã™ã€‚ Mozilla Firefoxã«ãŠã‘ã‚‹0x80ã®ç„¡è¦– Mozil
shimooka 2009/09/11
security

xss

binary

ie
ãƒªãƒ³ã‚¯
ç¬¬3å›žã€€US-ASCIIã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° | gihyo.jp
ä»Šå›žã¯ã€US-ASCIIã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã¨ã„ã†è©±é¡Œã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ å‰å›žã¾ã§ã§èª¬æ˜Žã—ãŸUTF-7ã«ã‚ˆã‚‹XSSã¨åŒæ§˜ã«ã€æ”»æ’ƒè€…ã¯US-ASCIIã¨ã„ã†æ–‡å—ã‚³ãƒ¼ãƒ‰ã‚’å·§ã¿ã«åˆ©ç”¨ã™ã‚‹ã“ã¨ã§ã€IEã‚’å¯¾è±¡ã«XSSã‚’ç™ºç”Ÿã•ã›ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚US-ASCIIã«ã‚ˆã‚‹XSSã¯ã€UTF-7ã«ã‚ˆã‚‹XSSã¨é¡žä¼¼ç‚¹ã‚‚å¤šã„ãŸã‚ã€å‰å›žã¾ã§ã®èª¬æ˜Žã‚‚ä½µã›ã¦èªã‚“ã§ãŠãã¨ã‚ˆã„ã§ã—ã‚‡ã†ã€‚ US-ASCIIã«ã‚ˆã‚‹XSSã«ã¤ã„ã¦ã‚‚å…ˆã«å¯¾ç–ã‚’æ›¸ã„ã¦ã—ã¾ã†ã¨ã€UTF-7ã®ã¨ãã¨åŒæ§˜ã«HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã«ã¦ Content-Type: text/html; charset=UTF-8 Content-Type: text/html; charset=Shift_JIS Content-Type: text/html; charset=EUC-JP ã®ã„ãšã‚Œã‹ã‚’å‡ºåŠ›ã™ã‚‹ã¨ã„ã†åŽŸå‰‡ã‚’å®ˆã‚‹ã“ã¨ã§ã€å®Œå…¨ã«æ”»æ’ƒ
shimooka 2009/09/11
encoding

security

xss

ie
ãƒªãƒ³ã‚¯
æ•™ç§‘æ›¸ã«è¼‰ã‚‰ãªã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ç¬¬1å›ž ï¼»ã“ã‚Œã¯ã²ã©ã„ï¼½IEã®å¼•ç”¨ç¬¦ã®è§£é‡ˆ âˆ’ ï¼ IT
XSSã«CSRFã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«â€¦â€¦Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãƒ—ãƒã‚°ãƒ©ãƒžãŒçŸ¥ã£ã¦ãŠãã¹ãè„†å¼±æ€§ã¯ã„ã£ã±ã„ã‚ã‚Šã¾ã™ã€‚ãã“ã§æœ¬é€£è¼‰ã§ã¯ã€ãã®ã‚ˆã†ãªãƒ¡ã‚¸ãƒ£ãƒ¼ãªã‚‚ã®â€œä»¥å¤–â€ã‚‚æŽ˜ã‚Šä¸‹ã’ã¦ã„ãã¾ã™ï¼ˆç·¨é›†éƒ¨ï¼‰ å°ã•ãªè©±é¡ŒãŒé¢ç™½ã„ çš†ã•ã‚“ã€ã¯ã˜ã‚ã¾ã—ã¦ã€‚ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ã¨ç”³ã—ã¾ã™ã€‚ ã€Œæ•™ç§‘æ›¸ã«è¼‰ã‚‰ãªã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã¨ã„ã†ã“ã¨ã§ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢é€£ã™ã‚‹ã€æ™®æ®µã‚ã¾ã‚Šè¦‹æŽ›ã‘ãªã„ã‚ˆã†ãªå°ã•ãªè©±é¡Œã‚’å–ã‚Šä¸Šã’ã¦ã„ããŸã„ã¨æ€ã„ã¾ã™ã€‚ ã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’å®Ÿç¾ã™ã‚‹ãŸã‚ã«ã€é–‹ç™ºè€…ã®æ–¹ã ã‘ã§ãªãã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§æ¤œæŸ»ã‚’è¡Œã†æ–¹ã€…ã«ã‚‚èªã‚“ã§ã„ãŸã ããŸã„ã¨æ€ã£ã¦ã„ã¾ã™ã€‚é‡ç®±ã®éš…ã‚’æ¥Šæžã§ã»ã˜ãã‚‹ã‚ˆã†ãªå°ã•ãªè©±é¡Œã°ã‹ã‚Šã§ã™ãŒã€çš†ã•ã‚“ã‚ˆã‚ã—ããŠé¡˜ã„ã—ã¾ã™ã€‚ ã•ã¦ç¬¬1å›žã¯ã€Internet ExplorerãŒHTMLã‚’è§£é‡ˆã™ã‚‹éš›ã®å¼•ç”¨
shimooka 2009/03/25
ãƒãƒƒã‚¯ã‚¯ã‚ªãƒ¼ãƒˆã‚‚ä½¿ãˆã‚‹ã®ã‹

security

ie
ãƒªãƒ³ã‚¯
è‘‰ã£ã±æ—¥è¨˜ - ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã® HKCRï¿¥MIMEï¿¥Databaseï¿¥charset ä»¥ä¸‹ã«å®šç¾©ã•ã‚Œã¦ã„ã¾ã™ã€‚
UTF-7ã‚’åˆ©ç”¨ã—ãŸXSSã¯ã€charset ãŒæŒ‡å®šã•ã‚Œã¦ã„ãªã„å ´åˆã«ç™ºç”Ÿã™ã‚‹ã¨è€ƒãˆã‚‰ã‚Œã¦ã„ã¾ã™ãŒã€å°‘ãªãã¨ã‚‚ Internet Explorer ã«ãŠã„ã¦ã¯ã€ã“ã‚Œã¯å¤§ããªé–“é•ã„ã§ã™ã€‚æ£ã—ãã¯ã€Internet Explorer ãŒèªè˜ã§ãã‚‹ charset ãŒæŒ‡å®šã•ã‚Œã¦ã„ãªã„å ´åˆã§ã‚ã‚Šã€charsetãŒä»˜åŠ ã•ã‚Œã¦ã„ã¦ã‚‚ã€IEãŒèªè˜ã§ããªã„æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åã§ã‚ã‚‹å ´åˆã«ã¯XSSãŒç™ºç”Ÿã—ã¾ã™ã€‚ ä¾‹ãˆã°ã€æ¬¡ã®ã‚ˆã†ãª HTML ã¯(HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã§ charset ãŒæ˜Žç¤ºã•ã‚Œã¦ã„ãªã„å ´åˆ)IEãŒæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åã‚’æ£ã—ãèªè˜ã§ããªã„ãŸã‚ã€ãã®å†…å®¹ã‹ã‚‰UTF-7ã¨è§£é‡ˆã•ã‚Œã‚‹ãŸã‚ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå‹•ä½œã—ã¾ã™ã€‚"utf8"ã¨ã„ã†è¡¨è¨˜ã¯UTF-8ã®æ…£ç”¨çš„ãªè¡¨ç¾ã§ã¯ã‚ã‚Šã¾ã™ãŒã€ãƒã‚¤ãƒ•ãƒ³ãŒæŠœã‘ã¦ãŠã‚Šæ£ã—ã„è¡¨è¨˜ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ <html> <head> <meta http-equiv="Co
shimooka 2008/08/05
security

utf-7

xss

ie
ãƒªãƒ³ã‚¯
Atom ã‚„ RDF ã‚’åˆ©ç”¨ã—ãŸXSS - è‘‰ã£ã±æ—¥è¨˜
Internet Explorer ã®æ‚ªåé«˜ã„ Content-Type: ç„¡è¦–ã¨ã„ã†ä»•æ§˜ã‚’åˆ©ç”¨ã™ã‚‹ã¨ã€Atom ã‚„ RDF/RSS ã‚’åˆ©ç”¨ã—ã¦XSSã‚’ç™ºç”Ÿã§ãã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚æ¡ä»¶çš„ã«å¯¾è±¡ã¨ãªã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯å¤šãã¯ãªã„ã¨æ€ã„ã¾ã™ãŒã€ãã‚Œã§ã‚‚ã„ãã¤ã‹è©²å½“ã™ã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒå®Ÿåœ¨ã™ã‚‹ã“ã¨ã‚’ç¢ºèªã—ã¾ã—ãŸã€‚ä»¥ä¸‹ã®ä¾‹ã§ã¯ Atom ã®å ´åˆã«ã¤ã„ã¦æ›¸ã„ã¦ã„ã¾ã™ãŒ RDF/RSS ã§ã‚‚åŒæ§˜ã§ã™ã€‚ ä¾‹ãˆã°ã€http://example.com/search.cgi?output=atom&q=abcd ã¨ã„ã† URL ã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ã€ã€Œabcdã€ã¨ã„ã†æ–‡å—åˆ—ã®æ¤œç´¢çµæžœã‚’ Atom ã¨ã—ã¦è¿”ã™CGIãŒã‚ã£ãŸã¨ã—ã¾ã™ã€‚ GET /search.cgi?output=atom&q=abcd Host: example.com HTTP/1.1 200 OK Content-Type: ap
shimooka 2008/08/05
atom

ie

security

xss
ãƒªãƒ³ã‚¯
Googleã‚¹ãƒ—ãƒ¬ãƒƒãƒ‰ã‚·ãƒ¼ãƒˆã®A1ã‚»ãƒ«ã«HTMLã‚’æ›¸ã„ã¦CSVã§ä¿å˜ã™ã‚‹ã¨â€¦ | ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º | ãƒžã‚¤ã‚³ãƒŸã‚¸ãƒ£ãƒ¼ãƒŠãƒ«
Google Docsã‚¹ãƒ—ãƒ¬ãƒƒãƒ‰ã‚·ãƒ¼ãƒˆã®æœ€åˆã®ã‚»ãƒ«ã«HTMLã‚’æ›¸ã„ã¦CSVã§ä¿å˜ã™ã‚‹ã¨â€¦ Google Docsã«ã¯ä»Šã®ã¨ã“ã‚ãƒ¯ãƒ¼ãƒ‰ãƒ—ãƒã‚»ãƒƒã‚µã€ã‚¹ãƒ—ãƒ¬ãƒƒãƒ‰ã‚·ãƒ¼ãƒˆã€ãƒ—ãƒ¬ã‚¼ãƒ³ãƒ†ãƒ¼ã‚·ãƒ§ãƒ³ã®3ã¤ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒç”¨æ„ã•ã‚Œã¦ã„ã‚‹ã‚ã‘ã ãŒã€ã†ã¡ã‚¹ãƒ—ãƒ¬ãƒƒãƒ‰ã‚·ãƒ¼ãƒˆã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«IEã«é–¢é€£ã—ãŸèˆˆå‘³æ·±ã„è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒç™ºè¦šã—ãŸã€‚ã“ã‚Œã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®Billy Riosæ°ã«ã‚ˆã£ã¦ç™ºè¦‹ã•ã‚ŒãŸã‚‚ã®ã€‚ã™ã§ã«åŒè„†å¼±æ€§ã¯ä¿®æ£ã•ã‚Œã¦ã„ã‚‹ãŒã€Gmailã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆå½è£…ã®ã¨ãã®ã‚ˆã†ã«æ³¨æ„ã—ã¦ãŠãã¹ãå†…å®¹ã ã€‚ ã“ã®è„†å¼±æ€§(ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°)ã‚’åˆ©ç”¨ã•ã‚ŒãŸå ´åˆã€æ”»æ’ƒè€…ã¯GoogleãŒæä¾›ã—ã¦ã„ã‚‹Gmailã‚„Google Codeã€Google Docsã®ã»ã‹ã®ã‚µãƒ¼ãƒ“ã‚¹ãªã©è¨±å¯ã•ã‚Œã¦ã„ãªã„ã‚µãƒ¼ãƒ“ã‚¹ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒåŽŸç†çš„ã«å¯èƒ½ã«ãªã‚‹ã€‚ã“ã‚Œã¯IEãŒContent-Typesã®æŒ‡å®šã•ã‚ŒãŸã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®è§£
shimooka 2008/04/17
google

ie

security
ãƒªãƒ³ã‚¯
å¾³ä¸¸æµ©ã®æ—¥è¨˜ - mod_imagefightè€ƒ - ç”»åƒç‰ˆã‚µãƒ‹ã‚¿ã‚¤ã‚ºè¨€ã†ãª
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã¯ãŠã™ã¿ã§ã™ã‹? é–‹ç™ºé–‹å§‹æ™‚ç‚¹ã‹ã‚‰ã®ã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°ã‹ã‚‰ã€å…¬é–‹æ¸ˆã¿Webã‚µã‚¤ãƒˆã®è„†å¼±æ€§æ¤œæŸ»ã€ è„†å¼±æ€§ç™ºè¦‹å¾Œã®é©åˆ‡ãªå¯¾ç–ã¾ã§ â— ç”»åƒç‰ˆã‚µãƒ‹ã‚¿ã‚¤ã‚ºè¨€ã†ãª ã—ã°ã‚‰ãå‰ã‹ã‚‰ã€ç«¹è¿«ã•ã‚“ã®ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒˆ(mod_imagefight)ãŒã€ç¬¬10å›žã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚‚ã¿ã˜ã‚»ãƒŸãƒŠãƒ¼ãªã¨ã§ç™ºè¡¨ã•ã‚Œè©±é¡Œã«ãªã£ã¦ã„ã¾ã—ãŸãŒã€LLé‚ã§ç™ºè¡¨ã•ã‚ŒãŸãƒ—ãƒ¬ã‚¼ãƒ³è³‡æ–™ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã®ã§ã€ç§ã‚‚ã‚ˆã†ã‚„ãå†…å®¹ã‚’è¦‹ã•ã›ã¦ã„ãŸã ãã¾ã—ãŸã€‚ å…ˆæ—¥ã€PHPã®æ”»æ’ƒã‚³ãƒ¼ãƒ‰ãŒéš ã•ã‚ŒãŸç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ãŒã€å¤§æ‰‹ãƒ›ã‚¹ãƒ†ã‚£ãƒ³ã‚°ã‚µã‚¤ãƒˆã§ç™ºè¦‹ã•ã‚ŒãŸã¨ã®å ±é“ãŒãªã•ã‚Œã¾ã—ãŸã€‚GIF,PNG,JPEG,BMPå½¢å¼ã®ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«ã¯ã€PHPã®RFIæ”»æ’ƒã§ä½¿ç”¨ã•ã‚Œã‚‹ã‚³ãƒ¼ãƒ‰ã‚„JavaScriptã®ã‚½ãƒ¼ã‚¹ãªã©ã‚’åŸ‹ã‚è¾¼ã‚€ã“ã¨ãŒã§ãã¾ã™ã€‚ç”»åƒã«åŸ‹ã‚è¾¼ã¾ã‚ŒãŸæ”»æ’ƒã‚³ãƒ¼ãƒ‰ã¨æˆ¦ã†5ã¤ã®æ–¹æ³•ã«ã¤ã„ã¦è§£èª¬ã—ã€å®‰å…¨ãªç”»åƒã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ€ã®å®Ÿè£…ã«ã¤ã„ã¦è€ƒå¯Ÿã—ã¾ã™ã€‚
shimooka 2007/10/02
ie

security

xss
ãƒªãƒ³ã‚¯
1