IE8ã®XSSフィルタãŒè£ç›®ã«å‡ºã‚‹ä¾‹ - 2009-06-22 - T.Teradaã®æ—¥è¨˜IE8ã®XSSフィルタã¯ã€Webアプリã«XSS脆弱性ãŒã‚ã£ãŸã¨ã—ã¦ã‚‚ã€ãã‚ŒãŒç™ºå‹•ã™ã‚‹å¯èƒ½æ€§ã‚’減らã—ã¦ãれるもã®ã§ã™ã€‚ ã—ã‹ã—ã€ãã®XSSフィルタãŒè£ç›®ã«å‡ºã‚‹ã‚ˆã†ãªã“ã¨ã‚‚ã‚ã‚Šã¾ã™ã€‚ 例ãˆã°ã€ä»¥ä¸‹ã®ã‚ˆã†ãªé™çš„ãªHTMLファイル（test.html）を作ã£ã¦Webサーãƒã«ãŠãã¾ã™ã€‚ <h3>ie8 test</h3> <!-- 1 --> <script> var u=document.URL; </script> <!-- 2 --> <script> u=u.replace(/&/g,'&').replace(/</g,'<'); </script> <!-- 3 --> <script> document.write('URL:'+u); </script> 上ã®ãƒšãƒ¼ã‚¸ã¯é™çš„ãªãƒšãƒ¼ã‚¸ã§ã€DOM Based XSSã®è„†å¼±æ€§ã‚‚ã‚ã‚Šã¾ã›ã‚“。ã§ã™ãŒã€è¢«å®³è€…ã®ãƒ¦ãƒ¼ã‚¶ãŒIE8を使ã£ã¦ã„ã‚‹
[SECURITY] XSS Filter Improvements in IE8 RC1 ã®æ—¥æœ¬èªžè¨³ - 葉ã£ã±æ—¥è¨˜![[SECURITY] XSS Filter Improvements in IE8 RC1 ã®æ—¥æœ¬èªžè¨³ - 葉ã£ã±æ—¥è¨˜](https://cdn-ak-scissors.b.st-hatena.com/image/square/84e8b77da84662d12d01b319650a3fc01299955a/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F13208692334729887943%2F17680117126985328902%2F1551408401)
The websecurity November 2008 Archive by thread
IE8βã®è¬Ž | 水無月ã°ã‘らã®ãˆã³æ—¥è¨˜
第13回Admintech.jp勉強会 - 葉ã£ã±æ—¥è¨˜
Archived MSDN and TechNet Blogs | Microsoft Docs
IE 8ã®ã‚»ã‚ュリティ強化，XSS攻撃ã¨ãƒžãƒ«ã‚¦ã‚¨ã‚¢å¯¾ç–フィルタをæ載
random dross
IEBlog
{{#tags}}- {{label}}
{{/tags}}