[B! JavaScript][facebook] Cherenkovã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

Cherenkov id:Cherenkov

JavaScriptã¨facebookã«é–¢ã™ã‚‹Cherenkovã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Facebookã®ãƒ‡ã‚¶ã‚¤ãƒ³ã«ã‚‚è² ã‘ãªã„è¶…ã‚«ãƒƒã‚³ã„ã„ã‚¿ã‚¤ãƒ ãƒ©ã‚¤ãƒ³ã‚’ä½œã‚‹JSãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒTimelineã€:phpspoté–‹ç™ºæ—¥èªŒ
Facebookã®ãƒ‡ã‚¶ã‚¤ãƒ³ã«ã‚‚è² ã‘ãªã„è¶…ã‚«ãƒƒã‚³ã„ã„ã‚¿ã‚¤ãƒ ãƒ©ã‚¤ãƒ³ã‚’ä½œã‚‹JSãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒTimelineã€ 2012å¹´04æœˆ02æ—¥- Timeline Facebookã®ãƒ‡ã‚¶ã‚¤ãƒ³ã«ã‚‚è² ã‘ãªã„è¶…ã‚«ãƒƒã‚³ã„ã„ã‚¿ã‚¤ãƒ ãƒ©ã‚¤ãƒ³ã‚’ä½œã‚‹JSãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒTimelineã€ã€‚ ä¸€è¦‹ã‚¹ãƒ©ã‚¤ãƒ‰ã‚·ãƒ§ãƒ¼ã®ã‚ˆã†ã§ã‚‚ã‚ã‚Šã¾ã™ãŒã€ã‚¿ã‚¤ãƒ ãƒ©ã‚¤ãƒ³ä»˜ãã®ã‚¹ãƒ©ã‚¤ãƒ‰ã‚·ãƒ§ãƒ¼ã«ãªã£ã¦ã„ã¾ã™ã€‚ä½•ã‹ã®æ´å²ã‚’èªžã‚‹æ™‚ã«ã¯æ˜¯éžä½¿ã„ãŸã„ã¨æ€ã£ã¦ã—ã¾ã†ç¨‹ã®ã‚¯ã‚ªãƒªãƒ†ã‚£ã§ã™ã€‚ ã‚¹ãƒ©ã‚¤ãƒ‰ã‚·ãƒ§ãƒ¼å†…ã«ã¯HTMLãªã‚‰ãªã‚“ã§ã‚‚åŸ‹ã‚è¾¼ã‚ã‚‹ã¨ã„ã†ã“ã¨ã§Youtubeã‚„Googleãƒžãƒƒãƒ—ãŒã„ã„æ„Ÿã˜ã«ãƒ¬ã‚¤ã‚¢ã‚¦ãƒˆã•ã‚Œã¦è¡¨ç¤ºã•ã‚Œã¦ã„ã¾ã™ã€‚ ã‚¹ãƒ©ã‚¤ãƒ‰ã‚·ãƒ§ãƒ¼ã¨é€£å‹•ã—ã¦ã‚¿ã‚¤ãƒ ãƒ©ã‚¤ãƒ³ã‚‚ã‚¢ãƒ‹ãƒ¡ãƒ¼ã‚·ãƒ§ãƒ³ã—ã¾ã™ã€‚ã‚¿ã‚¤ãƒ ãƒ©ã‚¤ãƒ³å´ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¦ã‚¹ãƒ©ã‚¤ãƒ‰ã‚·ãƒ§ãƒ¼ã®ä½ç½®ã‚’é¸æŠžã™ã‚‹ã“ã¨ã‚‚å¯èƒ½ã€‚ ã‚¹ãƒ©ã‚¤ãƒ‰ã‚·ãƒ§ãƒ¼éƒ¨åˆ†ã¯ãƒ‰ãƒ©ãƒƒã‚°ï¼†ãƒ‰ãƒãƒƒãƒ—ã§ç§»å‹•ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ ã‚¿ã‚¤ãƒ ãƒ©ã‚¤ãƒ³éƒ¨åˆ†ã®æ‹¡å¤§ã€‚ã†ã€œã‚“ç´ æ™´ã‚‰ã—ã„ï¼ ã“ã®
Cherenkov 2012/04/03
facebook

javascript

jQuery

webdesign

timeline
ãƒªãƒ³ã‚¯
Self-XSSã¯ãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ã‹ | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
å…¬é–‹: 2011å¹´11æœˆ20æ—¥20æ™‚20åˆ†é ƒ ã“ã‚“ãªè¨˜äº‹ãŒâ€¦â€¦ã€ŒFacebookã®å•é¡Œç”»åƒã®æ°¾æ¿«ã¯Webãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ã«åŽŸå› ã‹ï¼Ÿ (www.itmedia.co.jp)ã€ã€‚ Facebookã¯ãƒ¡ãƒ‡ã‚£ã‚¢ã«å¯„ã›ãŸã‚³ãƒ¡ãƒ³ãƒˆã§ã€ã“ã®æ”»æ’ƒã«ã¯Webãƒ–ãƒ©ã‚¦ã‚¶ã®ã€Œself-XSSã€ã®è„†å¼±æ€§ãŒæ‚ªç”¨ã•ã‚ŒãŸã¨ã®è¦‹æ–¹ã‚’æ˜Žã‚‰ã‹ã«ã—ãŸã€‚ (ï½žä¸ç•¥ï½ž) ä»Šå›žã®æ”»æ’ƒã§ã¯ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒä¸æ£ãªJavaScriptã‚’Webãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã«ã‚³ãƒ”ãƒ¼ï¼†ãƒšãƒ¼ã‚¹ãƒˆã™ã‚‹ã‚ˆã†ä»•å‘ã‘ã‚‰ã‚ŒãŸã¨ã•ã‚Œã‚‹ã€‚ç¾æ™‚ç‚¹ã§ã€ã©ã®Webãƒ–ãƒ©ã‚¦ã‚¶ãŒå½±éŸ¿ã‚’å—ã‘ã‚‹ã®ã‹ã¯åˆ†ã‹ã£ã¦ã„ãªã„ã€‚ ãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã«javascript:ã§å§‹ã¾ã‚‹æ–‡å—åˆ—ã‚’ã‚³ãƒ”ãƒ¼ã•ã›ã¦ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®Ÿè¡Œã•ã›ã‚‹ã¨ã„ã†è©±ã§ã™ãŒã€ã“ã‚Œã€ãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ãªã®ã§ã—ã‚‡ã†ã‹ã€‚ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒè‡ªã‚‰ã‚³ãƒ”ãƒ¼ã—ã¦å®Ÿè¡Œã—ã¦ã—ã¾ã†ã®ã§ã¯ã©ã†ã—ã‚ˆã†ã‚‚ãªã„ã‚ˆã†ãªâ€¦â€¦ã€‚ â€¦â€¦ã¨ã€æ€ã£ãŸã‚‰ã€å®Ÿã¯æœ€è¿‘ã®ãƒ–ãƒ©ã‚¦ã‚¶ã§ã¯ã‘ã£ã“ã†å¯¾ç–
Cherenkov 2012/02/21
xssãƒ•ã‚£ãƒ«ã‚¿

xss

facebook

javascript
ãƒªãƒ³ã‚¯
Facebookã®å•é¡Œç”»åƒã®æ°¾æ¿«ã¯Webãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ã«åŽŸå› ã‹ï¼Ÿ
Facebookã«ãƒãƒ«ãƒŽã‚„å‹•ç‰©è™å¾…ãªã©ã®ç”»åƒãŒç›¸æ¬¡ã„ã§æŽ²è¼‰ã•ã‚ŒãŸå•é¡Œã¯ã€Webãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ã‚’çªã„ãŸæ”»æ’ƒã«ã‚ˆã‚‹ã‚‚ã®ã§ã¯ãªã„ã‹ã¨ã®è¦‹æ–¹ãŒæµ®ä¸Šã—ã¦ã„ã‚‹ã€‚ Facebookã®ã‚¦ã‚©ãƒ¼ãƒ«ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼æœ¬äººã®è¨±å¯ãªããƒãƒ«ãƒŽã‚„å‹•ç‰©è™å¾…ãªã©ã®ç”»åƒãŒæŽ²è¼‰ã•ã‚Œã‚‹è¢«å®³ãŒç¶šå‡ºã—ãŸå•é¡Œã‚’ã‚ãã‚Šã€Webãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ã‚’çªã„ãŸæ”»æ’ƒãŒä»•æŽ›ã‘ã‚‰ã‚ŒãŸã®ã§ã¯ãªã„ã‹ã¨ã®è¦‹æ–¹ãŒæµ®ä¸Šã—ã¦ã„ã‚‹ã€‚ ã“ã®å•é¡Œã§ã¯ãƒ¦ãƒ¼ã‚¶ãƒ¼æœ¬äººãŒçŸ¥ã‚‰ãªã„ã†ã¡ã«ãƒ‹ãƒ¥ãƒ¼ã‚¹ãƒ•ã‚£ãƒ¼ãƒ‰ã«ç”»åƒãŒæŽ²è¼‰ã•ã‚Œã€Facebookã«ã¯æš´åŠ›ã‚·ãƒ¼ãƒ³ã‚„æœ‰åäººã®ã‚¢ãƒ€ãƒ«ãƒˆã‚·ãƒ¼ãƒ³ãªã©ã®å•é¡Œç”»åƒãŒã‚ãµã‚Œè¿”ã£ãŸã€‚Facebookã¯ãƒ¡ãƒ‡ã‚£ã‚¢ã«å¯„ã›ãŸã‚³ãƒ¡ãƒ³ãƒˆã§ã€ã“ã®æ”»æ’ƒã«ã¯Webãƒ–ãƒ©ã‚¦ã‚¶ã®ã€Œself-XSSã€ã®è„†å¼±æ€§ãŒæ‚ªç”¨ã•ã‚ŒãŸã¨ã®è¦‹æ–¹ã‚’æ˜Žã‚‰ã‹ã«ã—ãŸã€‚ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼æ¥Sophosã®11æœˆ16æ—¥ã®ãƒ–ãƒã‚°ã«ã‚ˆã‚Œã°ã€XSSï¼ˆã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼‰ã¨ã¯ã€æ”»æ’ƒè€…ãŒWebãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§JavaScrip
Cherenkov 2011/11/17
ã‚½ãƒ¼ã‚·ãƒ£ãƒ«ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚° ã‚³ãƒ”ãƒš

security

facebook

xss

javascript

browser
ãƒªãƒ³ã‚¯
Facebookã®JavaScript SDKã®ä¸‹å“ãªã‚³ãƒ¡ãƒ³ãƒˆãŒæ ¼å¥½è‰¯ã™ãŽã¦æƒšã‚ŒãŸä»¶ - kissrobberã®æ—¥è¨˜
https://github.com/facebook/connect-js/blob/master/src/core/content.js#L113 // Dear IE, screw you. Only works with the magical incantations. // Dear FF, screw you too. Needs src _after_ DOM insertion. // Dear Webkit, you're okay. Works either way. var guid = FB.guid(), â€¦ç¶šã è¦ªæ„›ãªã‚‹IEã¸ã€ æ»ãã€‚ è¬Žã®å‘ªæ–‡ã‚’ä½¿ã‚ãªã„ã¨å‹•ã‹ãªã„â€¦ è¦ªæ„›ãªã‚‹FFã¸ã€ ãŠå‰ã‚‚æ»ãã€‚ DOMæŒ¿å…¥å¾Œã«srcè¨å®šå¿…è¦ è¦ªæ„›ãªã‚‹Webkitã¸ã€ ãŠå‰ã¯ã„ã„ã ã‚ã†ã€‚ ã©ã£ã¡ã§ã‚‚å‹•ãã€‚
Cherenkov 2011/09/10
facebook

JavaScript

funny
ãƒªãƒ³ã‚¯
ã‚†ãƒ¼ã™ã‘ã¹ãƒ¼æ—¥è¨˜
ã‚µã‚ã¨ã¯å½¼å¥³ã®è‡ªå®…è¿‘ãã€æ¹˜å—å°é§…å‰ã®ã‚¹ãƒ¼ãƒ‘ãƒ¼ãƒžãƒ¼ã‚±ãƒƒãƒˆã§å¾…ã¡åˆã‚ã›ã‚’ã—ãŸã€‚å½¼å¥³ã¯è‡ªè»¢è»Šã§å¾Œã‹ã‚‰è¿½ã„ã¤ãã¨è¨€ã„ã€åƒ•ã¯å¤§ããªã‚³ã‚¤ãƒ³ãƒ‘ãƒ¼ã‚ãƒ³ã‚°ã¸è»Šã‚’åœã‚ãŸã€‚ç…™è‰ã‚’ä¸€æœ¬å¸ã£ã¦ã‹ã‚‰ã‚¹ãƒ¼ãƒ‘ãƒ¼ãƒžãƒ¼ã‚±ãƒƒãƒˆã¸å‘ã‹ã†ã¨ã€ã²ã£ãã‚Šãªã—ã«ä¸»å©¦çš„ãªå¥³æ€§ã‹ãŠã°ã‚ã¡ã‚ƒã‚“ãŒå…¥ã‚Šå£ã‚’å‡ºãŸã‚Šå…¥ã£ãŸã‚Šã—ã¦ã„ãŸã€‚æ™‚åˆ»ã¯åˆå¾Œ5æ™‚ã«ãªã‚‹ã€‚æ™‚è¨ˆã‹ã‚‰ç›®ã‚’ä¸Šã’ã‚‹ã¨ã€å¾…ãŸã›ã¡ã‚ƒã£ãŸã‚ãã¨å¤§ã—ã¦æ‚ªã³ã‚Œã¦ãªã„æ§˜åã§ã‚µã‚ãŒæ‰‹ã¶ã‚‰ã§ã‚„ã£ã¦ããŸã€‚ ãŠç¤¼ã«æ–™ç†ã‚’ä½œã‚‹ã¨ã¯ã„ãˆã€ã‚µã‚ã®å®¶ã«ã¯é£ŸæãŒååˆ†è¶³ã‚Šã¦ã„ãªã„ã‚‰ã—ãã€ã“ã†ã—ã¦ã‚¹ãƒ¼ãƒ‘ãƒ¼ãƒžãƒ¼ã‚±ãƒƒãƒˆã«å¯„ã‚‹ã“ã¨ã«ãªã£ãŸã€‚ã‚µã‚ã¯é‡Žèœã‚³ãƒ¼ãƒŠãƒ¼ã‹ã‚‰ç²¾è‚‰ã‚³ãƒ¼ãƒŠãƒ¼ã¾ã§ã€ã¾ã‚‹ã§å„ªç§€ãªã‚«ãƒ¼ãƒŠãƒ“ã«å°Žã‹ã‚Œã‚‹ã‚ˆã†ã«ç„¡é§„ãªãç‚¹æ¤œã—ã¦ã„ã£ãŸã€‚æ¬²ã—ã„é£ŸæãŒã‚ã‚‹ã¨ã€2ç§’é–“ç¨‹åº¦ãã‚Œã‚‰ã‚’å‡è¦–ã—ã€ä¸€åº¦æ‰‹ã«å–ã£ãŸã˜ã‚ƒãŒã„ã‚‚ã‚„ã‚‰è±šè‚‰ã‚„ã‚‰ã‚’è¿·ã†ã“ã¨ãªãåƒ•ãŒæŒã£ã¦ã„ã‚‹ã‚«ã‚´ã«æ”¾ã‚Šè¾¼ã‚“ã ã€‚æœ€å¾Œã«ã‚¢ãƒ«ã‚³ãƒ¼ãƒ«é£²æ–™ãŒå†·ã‚„ã•ã‚Œã¦ã„ã‚‹æ£šã®å‰ã¸è¡Œãã¨ã€ç§ãŒé£²ã‚€ã‹ã‚‰ã¨ãƒ
Cherenkov 2011/03/12
Facebook Graph API

facebook

api

Javascript

tutorial

sample
ãƒªãƒ³ã‚¯
An interesting way to determine if you are logged into social web sites âœ© Mozilla Hacks â€“ the Web developer blog
Thanks! Please check your inbox to confirm your subscription. If you havenâ€™t previously confirmed a subscription to a Mozilla-related newsletter you may have to do so. Please check your inbox or your spam filter for an em ail from us. Jan! You could upload an image to a security-sensitive bug in Bugzilla to check if a user is logged in as a member of the security group, but this would change over t
Cherenkov 2011/02/07
img ãƒã‚°ã‚¤ãƒ³ã—ãŸçŠ¶æ…‹ã§ã®ã¿ã‚¢ã‚¯ã‚»ã‚¹ã§ãã‚‹ç”»åƒã«onload onerrorã‚’ä»˜ã‘ã¦ãƒã‚°ã‚¤ãƒ³åˆ¤å®š

gmail

facebook

privacy

JavaScript

security

Tips

cookie

webservice

idea
ãƒªãƒ³ã‚¯
Abusing HTTP Status Codes to Expose Private Information - Grepular
Abusing HTTP Status Codes to Expose Private InformationWritten 15 years ago by MikeÂ Cardwell Update: Some of the example tests on this page no longer work (I donâ€™t have a Facebook account anymore and the Twitter URL I used went offline). The technique itâ€™s self is still alive and relevant though. When you visit my website, I can automatically and silently determine if youâ€™re logged into Facebook,
Cherenkov 2011/02/07
img ãƒã‚°ã‚¤ãƒ³ã—ãŸçŠ¶æ…‹ã§ã®ã¿ã‚¢ã‚¯ã‚»ã‚¹ã§ãã‚‹ç”»åƒã«onload onerrorã‚’ä»˜ã‘ã¦ãƒã‚°ã‚¤ãƒ³åˆ¤å®š

gmail

facebook

privacy

JavaScript

security

Tips

cookie
ãƒªãƒ³ã‚¯
ã€Œã„ã„ãï¼ã€ãƒœã‚¿ãƒ³è¨ç½®æ–¹æ³• - Facebooké–‹ç™ºè€…
As Metaâ€™s developer platform continues to evolve, we're making strategic decisions to focus on tools and features that deliver the most value to developers and businesses. Today, we're announcing that two Facebook Social Plugins - the Facebook Like button and the Facebook Comment button - will be discontinued on February 10, 2026. FB Like Button - Allows users to like external website content FB C
Cherenkov 2010/09/07
ã„ã„ããƒœã‚¿ãƒ³

facebook

SNS

Javascript
ãƒªãƒ³ã‚¯
1