[B! xss] ama-chã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ama-ch id:ama-ch

xssã«é–¢ã™ã‚‹ama-chã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (45)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Vueã‚’SSRã«ä¹—ã›ã‚‹ã¨å®¹æ˜“ã«XSSã‚’ç”Ÿã¿å‡ºã™å ´åˆãŒã‚ã‚‹ä»¶ã«ã¤ã„ã¦ - Qiita
ã¯ã˜ã‚ã« æœ€è¿‘Vue.jsã‚’é »ç¹ã«ä½¿ç”¨ã™ã‚‹ã®ã§ã™ãŒã€ä»–ã®SSR(ã‚µãƒ¼ãƒãƒ¼ã‚µã‚¤ãƒ‰ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°)ã®ä»•çµ„ã¿ã¨çµ„ã¿åˆã‚ã›ã‚‹å ´åˆã€å®¹æ˜“ã«XSSã‚’ç”Ÿã¿å‡ºã—ã¦ã—ã¾ã†ã‚±ãƒ¼ã‚¹ãŒå˜åœ¨ã™ã‚‹ã®ã§ã€æ³¨æ„å–šèµ·ã‚‚å…¼ãã¦äº‹ä¾‹ã‚’ç´¹ä»‹ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ 9æœˆ7æ—¥ è¿½è¨˜ã‚’è¿½è¨˜ã—ã¾ã—ãŸ å‰æ ã‚µãƒ¼ãƒãƒ¼ã‚µã‚¤ãƒ‰ã§å‹•çš„ã«è¦ç´ ã‚’ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã™ã‚‹ã‚·ã‚¹ãƒ†ãƒ ã¨Vue.jsã‚’çµ„ã¿åˆã‚ã›ãŸå ´åˆ ã“ã®è¨˜äº‹ã¯railsã®SSRã¨ã®çµ„ã¿åˆã‚ã›ã§è§£èª¬ã—ã¾ã™ãŒã€ãƒ—ãƒ¬ãƒ¼ãƒ³ãªPHPç‰ã€å‹•çš„ã«HTMLã‚’ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã‚·ã‚¹ãƒ†ãƒ ã¨ã®çµ„ã¿åˆã‚ã›ã§ã‚‚ç™ºç”Ÿã—ã¾ã™ã€‚ ã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ ã¾ãšã€ã“ã¡ã‚‰ã®ã‚³ãƒ¼ãƒ‰ã‚’ã”è¦§ãã ã•ã„ã€‚ user.erb <div id="app"> <div class="user"> <%= @user.name %> </div> <button v-on:click="regis terFavorite" data-user-id="<%= @user
ama-ch 2017/09/10
Vue.js

xss
ãƒªãƒ³ã‚¯
Electronã§ã‚¢ãƒ—ãƒªã‚’æ›¸ãå ´åˆã¯ã€æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’ç™ºç”Ÿã•ã›ãªã„ã‚ˆã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ - è‘‰ã£ã±æ—¥è¨˜
ãã®ã†ã¡ã‚‚ã†å°‘ã—ãã¡ã‚“ã¨æ›¸ãã¾ã™ãŒã€ã¨ã‚Šã‚ãˆãšæ™‚é–“ãŒãªã„ã®ã§çµè«–ã ã‘æ›¸ãã¨ã€ã‚¿ã‚¤ãƒˆãƒ«ãŒå…¨ã¦ã§Electronã§ã‚¢ãƒ—ãƒªã‚’æ›¸ãå ´åˆã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’ç™ºç”Ÿã•ã›ãªã„ã‚ˆã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ ã“ã‚Œã¾ã§Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ä¸Šã§XSSãŒå˜åœ¨ã—ãŸã¨ã—ã¦ã‚‚ã€å½±éŸ¿ç¯„å›²ã¯ãã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä¸ã«ç•™ã¾ã‚‹ã®ã§ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®æä¾›å´ãŒãã‚Œã‚’è¨±å®¹ã™ã‚‹ã®ã§ã‚ã‚Œã°XSSã®å˜åœ¨ã«ç›®ã‚’ã¤ã‚€ã‚‹ã“ã¨ã‚‚ã§ããŸã€‚ã—ã‹ã—ã€Electronã‚¢ãƒ—ãƒªã§DOM-based XSSãŒä¸€ã‹æ‰€ã§ã‚‚ç™ºç”Ÿã™ã‚‹ã¨ã€(ãŠãã‚‰ã)ç¢ºå®Ÿã«ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã¸ã¨ã¤ãªãŒã‚Šã€åˆ©ç”¨è€…ã®PCã®(ãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼æ¨©é™ã§ã®)å…¨æ©Ÿèƒ½ãŒæ”»æ’ƒè€…ã«ã‚ˆã£ã¦åˆ©ç”¨ã§ãã‚‹ã€‚ ãã®ãŸã‚ã€Electronã§ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œæˆã™ã‚‹é–‹ç™ºè€…ã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’å®Œå…¨ã«ã¤ã¶ã•ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ nodeIntegration:falseã‚„Content-Security-Pol
ama-ch 2015/12/26
Electron

xss

security
ãƒªãƒ³ã‚¯
React.js ã« XSS å¯¾ç–ã‚’æ±‚ã‚ã‚‹ã®ã¯é–“é•ã£ã¦ã„ã‚‹ã ã‚ã†ã‹
Transcript 1. React.js ã« XSS å¯¾ç–ã‚’ æ±‚ã‚ã‚‹ã®ã¯é–“é•ã£ã¦ã„ã‚‹ ã ã‚ã†ã‹ #edomaesec 2015 5/30 LT 2. @clariroid 3. ãã‚‰ã‚Šã© 4. React.js 5. React.js 6. React.js é’ã„ç´ 7. React.js â€¢ UI ã‚’æ§‹ç¯‰ã™ã‚‹ JavaScript ãƒ©ã‚¤ãƒ–ãƒ©ãƒª 8. React.js â€¢ UI ã‚’æ§‹ç¯‰ã™ã‚‹ JavaScript ãƒ©ã‚¤ãƒ–ãƒ©ãƒª â€¢ Virtual DOM 9. React.js â€¢ UI ã‚’æ§‹ç¯‰ã™ã‚‹ JavaScript ãƒ©ã‚¤ãƒ–ãƒ©ãƒª â€¢ Virtual DOM â€¢ Component Composable 10. React.js â€¢ UI ã‚’æ§‹ç¯‰ã™ã‚‹ JavaScript ãƒ©ã‚¤ãƒ–ãƒ©ãƒª â€¢ Virtual DOM â€¢ Component Composable â€¢ Server-side R
ama-ch 2015/06/01
react

JSX

slide

xss

security
ãƒªãƒ³ã‚¯
XSSå¯¾ç–ã¨ã—ã¦ã®ES6ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆãƒªãƒ†ãƒ©ãƒ«
XSSå¯¾ç–ã¨ã—ã¦ã® ES6ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆãƒªãƒ†ãƒ©ãƒ« Shibuya.XSS Yosuke HASEGAWA ES6ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆãƒªãƒ†ãƒ©ãƒ« ES6ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆãƒªãƒ†ãƒ©ãƒ« â¤ãƒãƒƒã‚¯ã‚¯ã‚©ãƒ¼ãƒˆã§å›²ã£ã¦æ”¹è¡Œã‚‚å«ã‚ã‚‰ã‚Œ ã‚‹ var x = `æ”¹è¡Œã‚‚ ãƒ€ãƒ–ãƒ«ã‚¯ã‚©ãƒ¼ãƒˆã€Œ"ã€ã‚‚ ã‚·ãƒ³ã‚°ãƒ«ã‚¯ã‚©ãƒ¼ãƒˆã€Œ'ã€ã‚‚ ä½¿ãˆã‚‹ã‚ˆï¼`; alert( x ); ES6ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆãƒªãƒ†ãƒ©ãƒ« â¤ãƒ’ã‚¢ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã¨ã„ã†ã«ã¯å°‘ã—æ®‹å¿µ â¤å††è¨˜å·ã§ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ãŒç”Ÿãã¦ã‚‹â€¦ var x = `æ”¹è¡Œã‚‚Â¥nãƒãƒƒã‚¯ã‚¯ã‚©ãƒ¼ãƒˆÂ¥`ã‚‚ Â¥Â¥ã‚‚ä½¿ãˆã‚‹ã‚ˆï¼`; alert( x ); ES6ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆãƒªãƒ†ãƒ©ãƒ« â¤ãƒªãƒ†ãƒ©ãƒ«å†…ã«${...}ã§åŸ‹ã‚è¾¼ã‚“ã å¼ã‚’è©•ä¾¡ var name = "hasegawa"; var x = `Hello, ${name}-san`; console.log( x ); // "Hello, hasegawa-san" x = `ab
ama-ch 2015/02/18
ES6

xss

template
ãƒªãƒ³ã‚¯
GitHub - yahoo/webseclab: set of web security test cases and a toolkit to construct new ones
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
ama-ch 2015/02/12
xss

security
ãƒªãƒ³ã‚¯
innerText(textContent)/innerHTMLã‚’ä½¿ã£ãŸHTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã¯å……åˆ†ã§ãªã„ã®ã§ä»Šã™ãã‚„ã‚ã‚ã€ãŠå‰ãŸã¡ã¯ã‚‚ã†çµ‚ã‚ã‚Šã - TODESKING
// jQueryã§HTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ä¾‹ function escape(content) { return $('<div />').text(content).html() }
ama-ch 2015/02/10
xss

escape
ãƒªãƒ³ã‚¯
GitHub - mozilla/scanjs: [DEPRECATED] Static analysis tool for javascript code.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
ama-ch 2015/02/05
static analysis

security

xss
ãƒªãƒ³ã‚¯
Comparing DOM XSS Tools On Real World Bug
2. Index Introduction..........................................................................................................................................3 Document structure..............................................................................................................................3 Tools Comparison Criteria....................................................................
ama-ch 2015/02/05
xss

security

slide
ãƒªãƒ³ã‚¯
GitHub - dvolvox/JSpwn: JavaScript Static Code Analysis
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
ama-ch 2015/02/05
â€œJSPwn is a modified version of Scanjs + JSPrime.â€

static analysis

security

xss
ãƒªãƒ³ã‚¯
ScanJS
ScanJS Scan Rules Experiment
ama-ch 2015/02/05
static analysis

security

xss
ãƒªãƒ³ã‚¯
ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§Markdownã‚’å®‰å…¨ã«å±•é–‹ã™ã‚‹ - è‘‰ã£ã±æ—¥è¨˜
ä¸ç‰¹å®šã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒå…¥åŠ›ã—ãŸMarkdownã‚’ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§JavaScriptã‚’ä½¿ã£ã¦HTMLã«å¤‰æ›ã™ã‚‹ã¨ã„ã†å ´é¢ã«ãŠã„ã¦ã¯ã€JavaScriptã§å¤‰æ›ã—ã¦HTMLã‚’ç”Ÿæˆã™ã‚‹ã¨ã„ã†å‡¦ç†ã®éƒ½åˆä¸Šã©ã†ã—ã¦ã‚‚DOM-based XSSã®ç™ºç”Ÿã‚’è€ƒãˆãªã„ã‚ã‘ã«ã¯ã„ã‹ãªã„ã€‚ã‹ã¨ã„ã£ã¦ã€Markdownã‚’ãƒ‘ãƒ¼ã‚¹ã—HTMLã‚’ç”Ÿæˆã™ã‚‹ã¨ã„ã†å‡¦ç†ã™ã¹ã¦ã‚’XSSãŒå˜åœ¨ã—ãªã„ã‚ˆã†ã«æ³¨æ„ã—ãªãŒã‚‰è‡ªåˆ†ã§æ›¸ãã®ã‚‚å¤§å¤‰ã ã—ã€markedã‚„markdown-jsãªã©ã®æ—¢å˜ã®å¤‰æ›ç”¨ã®JSã‚’æŒã£ã¦ãã¦ã‚‚ãã‚Œã‚‰ãŒXSSã—ãªã„ã‹ã‚’ç¢ºèªã™ã‚‹ã®ã¯çµæ§‹å¤§å¤‰ã ã£ãŸã‚Šã™ã‚‹ã€‚ ãã†ã„ã£ãŸå ´åˆã«ã¯ã€Markdownã‹ã‚‰ç”Ÿæˆã•ã‚ŒãŸHTMLã‚’RickDOMã‚’é€šã™ã“ã¨ã§ã€ä¸‡ãŒä¸€HTMLå†…ã«JavaScriptãŒå«ã¾ã‚Œã¦ã„ãŸã¨ã—ã¦ã‚‚ãã‚Œã‚‰ã‚’é™¤å¤–ã—ã€è¨±å¯ã•ã‚ŒãŸè¦ç´ ã€è¨±å¯ã•ã‚ŒãŸå±žæ€§ã ã‘ã§æ§‹ç¯‰ã•ã‚ŒãŸå®‰å…¨ãªHTMLã«å†æ§‹ç¯‰ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚ã•ã‚‰ã«ã€ãã†ã‚„ã£ã¦ç”Ÿæˆ
ama-ch 2015/02/02
markdown

security

xss
ãƒªãƒ³ã‚¯
CSP Lv.2ã®è©±
#ssmjp 2014/10 XSSã®é‹ç”¨ã®è©± é–“é•ã„ãªã©ã‚ã‚Šã¾ã—ãŸã‚‰ @yagihashoo ã¾ã§ã€‚ ## 10/28 9:26è¿½è¨˜ nonce-valueã€è¦æ ¼ä¸Šã¯Base64ã ã‚ˆï¼ã¨ã„ã†æŒ‡æ‘˜ã‚’ã„ãŸã ã„ãŸã®ã§ã‚¹ãƒ©ã‚¤ãƒ‰18-19ã‚’ä¿®æ£ã—ã¾ã—ãŸã€‚ è©³ç´°ã¯ä»¥ä¸‹ã‚’ã”è¦§ãã ã•ã„ã€‚ http://www.w3.org/TR/CSP2/#source-list-valid-nonces ## 10/29 15:00è¿½è¨˜ Path matchingã®ä¾‹ç¤ºã«ã¤ã„ã¦é–“é•ã„ãŒã‚ã£ãŸãŸã‚ã‚¹ãƒ©ã‚¤ãƒ‰14ã‚’ä¿®æ£ã—ã¾ã—ãŸã€‚Read less
ama-ch 2014/10/29
csp

xss

slide
ãƒªãƒ³ã‚¯
æ–‡å—åˆ—ã‹ã‚‰HTMLã‚’çµ„ã¿ç«‹ã¦ã‚‹è©± Shibuya.XSS techtalk #5
ama-ch 2014/08/11
shibuya.xss

xss

security
ãƒªãƒ³ã‚¯
ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰é–‹ç™ºã®ãŸã‚ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ | ç¬¬1å›ž XSSã®å‚¾å‘ã¨å¯¾ç–
ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰é–‹ç™ºã®ãŸã‚ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ç¬¬1å›ž XSSã®å‚¾å‘ã¨å¯¾ç– æœ¬ã‚·ãƒªãƒ¼ã‚ºã§ã¯ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã®é–‹ç™ºã«é–¢ä¿‚ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã€ç†è§£ã‚’æ·±ã‚ã¾ã™ã€‚ç¬¬1å›žç›®ã¯XSSï¼ˆã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼‰ã§ã™ã€‚å®Ÿè£…å¤±æ•—ä¾‹ã‚’æŒ™ã’ã¤ã¤ã€å¯¾ç–ã®ãƒã‚¤ãƒ³ãƒˆã‚’è§£èª¬ã—ã¾ã™ã€‚ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¯ã‚µãƒ¼ãƒãƒ¼ã‚µã‚¤ãƒ‰ã®å•é¡Œï¼Ÿ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã‚ã‚‹ãƒŸã‚¹ã¯ã€ŒçŸ¥ã‚‰ãªã‹ã£ãŸã€ã§ã¯ã™ã¾ã•ã‚Œãªã„å ´åˆãŒã€å¾€ã€…ã«ã—ã¦ã‚ã‚Šã¾ã™ã€‚ ã¡ã‚‡ã£ã¨ã—ãŸãƒŸã‚¹ã§ãƒ—ãƒã‚°ãƒ©ãƒ ã«ãƒã‚°ã‚’ä½œã£ã¦ã—ã¾ã„ã€ã‚µãƒ¼ãƒ“ã‚¹ãŒä¸€éƒ¨å‹•ã‹ãªããªã£ãŸã¨ã—ã¦ã‚‚ç¨‹åº¦ã«ã‚‚ã‚ˆã‚Šã¾ã™ãŒã€ã™ãã«ä¿®æ£ã™ã‚Œã°ä¸€éƒ¨ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«å°‘ã—ä¸ä¾¿ã‚’ã‹ã‘ã¦ã—ã¾ã†ç¨‹åº¦ã§ã™ã‚€ã§ã—ã‚‡ã†*ã€‚ *æ³¨ï¼šã‚µãƒ¼ãƒ“ã‚¹é‹å–¶ ã“ã®è¨˜äº‹ã§ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®æŠ€è¡“çš„ãªå´é¢ã‚’æ‰±ã„ã¾ã™ã€‚ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ä¸ä¾¿ã‚’ã‹ã‘ã¦ã—ã¾ã£ãŸã“ã¨ã«å¯¾ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹æä¾›å´ã®å€«ç†çš„å•é¡Œã«ã¤ã„ã¦ã¯ãã®ã¤ã©è¨€åŠã¯ã—ã¾ã›ã‚“ãŒã€ã“ã‚Œã‚‰ã®å´é¢ã‚’è»½è¦–ã™ã¹ãã§ãªã„ã“ã¨ã¯ã„ã†ã¾ã§ã‚‚ã‚ã‚Šã¾ã›ã‚“ã€‚
ama-ch 2014/07/08
xss

security
ãƒªãƒ³ã‚¯
Masato Kinugawa Security Blog: CVE-2014-0509: ä¸Šä½ã‚µãƒã‚²ãƒ¼ãƒˆã‚’ä½¿ã£ãŸFlashã®XSS
Flashã®æ–‡å—åˆ—å‡¦ç†ã®æ–¹æ³•ãŒé©åˆ‡ã§ãªã„ãŸã‚ã«ã€ é©åˆ‡ã«XSSå¯¾ç–ãŒæ–½ã•ã‚ŒãŸFlashãƒ•ã‚¡ã‚¤ãƒ«ä¸Šã§ã‚‚XSSã‚’å¼•ãèµ·ã“ã›ã‚‹å ´åˆãŒã‚ã£ãŸå•é¡Œã«ã¤ã„ã¦æ›¸ãã¾ã™ã€‚ ã“ã®å•é¡Œã¯ä»¥ä¸‹ã«æŽ²è¼‰ã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ã«ã€ 2014å¹´4æœˆã®Flash Playerã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã§ä¿®æ£ã•ã‚Œã¾ã—ãŸã€‚ http://helpx.adobe.com/security/products/flash-player/apsb14-09.html These updates resolve a cross-site-scripting vulnerability (CVE-2014-0509). æœ¬å•é¡Œã¯ã€ ã“ã®ãƒ–ãƒã‚°ã§ã‚‚ä½•åº¦ã‹å–ã‚Šä¸Šã’ãŸ ExternalInterface.call() ã®å•é¡Œã«é–¢ä¿‚ã™ã‚‹ã‚‚ã®ã§ã™ã€‚å–ã‚Šä¸Šã’ãŸã®ã¯ã“ã®è¾ºã®è¨˜äº‹ã§ã™ï¼š Flashå‹•ç”»ãƒ—ãƒ¬ã‚¤ãƒ¤ãƒ¼ã€Œãµã‚‰ã ã‚“ã™ã€ã«å˜åœ¨ã—ãŸXSSã‹ã‚‰å¦ã¶ã€Flashã®XSS3ãƒ‘
ama-ch 2014/06/20
flash

xss

security
ãƒªãƒ³ã‚¯
Google Code Archive - Long-term storage for Google Code Project Hosting.
Code Archive Skip to content Google About Google Privacy Terms
ama-ch 2014/05/25
â€œDom Xss Test Cases Wiki is a KB for defining sources of attacker controlled inputs and sinks which potentially could introduce DOM Based Xss issues.â€

xss

security
ãƒªãƒ³ã‚¯
Qiitaã«XSSè„†å¼±æ€§ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
ama-ch 2014/04/10
xss

security
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
ama-ch 2014/01/21
security

xss
ãƒªãƒ³ã‚¯
å˜ç´”ã§ã¯ãªã„ã€æœ€æ–°ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã€äº‹æƒ…
å˜ç´”ã§ã¯ãªã„ã€æœ€æ–°ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã€äº‹æƒ…ï¼šHTML5æ™‚ä»£ã®ã€Œæ–°ã—ã„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ã‚¨ãƒã‚±ãƒƒãƒˆã€ï¼ˆ2ï¼‰ï¼ˆ1/3 ãƒšãƒ¼ã‚¸ï¼‰ é€£è¼‰ç›®æ¬¡ çš†ã•ã‚“ã“ã‚“ã«ã¡ã¯ã€‚ãƒãƒƒãƒˆã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆã®ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ã§ã™ã€‚ç¬¬1å›žç›®ã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å¢ƒç•Œæ¡ä»¶ã§ã‚ã‚‹ã‚ªãƒªã‚¸ãƒ³ã¨ã„ã†æ¦‚å¿µã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã—ãŸã€‚ ç¾åœ¨ã®Webãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼ã§ã¯ã€åŒä¸€ã‚ªãƒªã‚¸ãƒ³ã®ãƒªã‚½ãƒ¼ã‚¹ã¯åŒã˜ä¿è·ç¯„å›²ã«ã‚ã‚‹ã‚‚ã®ã¨ã—ã€ã‚ªãƒªã‚¸ãƒ³ã‚’è¶…ãˆãŸã‚¢ã‚¯ã‚»ã‚¹ã«ã¤ã„ã¦ã¯ãƒªã‚½ãƒ¼ã‚¹ã®æä¾›å…ƒãŒæ˜Žç¤ºçš„ã«è¨±å¯ã—ãªã„é™ã‚Šã¯ã‚¢ã‚¯ã‚»ã‚¹ã§ããªã„ã¨ã„ã†ã€ã€ŒåŒä¸€ã‚ªãƒªã‚¸ãƒ³ãƒãƒªã‚·ãƒ¼ï¼ˆSame-Origin Policyï¼‰ã€ã«å¾“ã£ã¦ãƒªã‚½ãƒ¼ã‚¹ã‚’ä¿è·ã—ã¦ã„ã¾ã™ã€‚ ãã®ä¿è·ç¯„å›²ã§ã‚ã‚‹ã‚ªãƒªã‚¸ãƒ³ã‚’è¶…ãˆã€ãƒªã‚½ãƒ¼ã‚¹ã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹æ”»æ’ƒã®ä»£è¡¨äº‹ä¾‹ã§ã‚ã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã«ã¤ã„ã¦ã€ä»Šå›žã€ãŠã‚ˆã³æ¬¡å›žã®2å›žã«åˆ†ã‘ã€HTML5ã«ãŠã„ã¦ã‚ˆã‚Šé«˜åº¦åŒ–ã•ã‚ŒãŸæ”»æ’ƒã¨ã€ãã®å¯¾ç–ã‚’èª¬æ˜Žã—ã¾
ama-ch 2013/12/20
security

xss
ãƒªãƒ³ã‚¯
jQuery Migrate Plugin ãªã‚“ã¦ãªã‹ã£ãŸä»¶ - ã»ã‚€ã‚‰ã¡ã‚ƒã»ã‚€ã»ã‚€
ã„ãã¤ã‹ã®ã‚µã‚¤ãƒˆã§å®Ÿéš›ã«éé‡ã—ã¦ã¾ã™ãŒï¼ŒjQueyr 1.6.3 ã§è§£æ±º( jQuery Bug #9521 )ã—ãŸã¯ãšã® $("a[href=" + hash + "]") ã‚¿ã‚¤ãƒ—ã® XSS ãŒ ï¼ˆ 2013/11/18 ç¾åœ¨ 1.2.1 ã‚’å«ã‚€å…¨ã¦ã®ï¼‰ jQuery Migrate Plugin ã§å¾©æ´»ã—ã¾ã™ï¼Ž jQuery 1.6.3 ã®ã¿ã®å ´åˆ jQuery 1.10.2 ã¨ Migrate Plugin 1.2.1 ã®å ´åˆ è‰²ã€…è¿½ã£ã¦ã¿ã¦ï¼Œã‚„ã£ã±ã‚Šã¾ã å‹•ãã‘ã©ã¨è¨€ã£ãŸã‚‰ï¼Œ8æœˆã«ã™ã§ã«ï¼Œå®Ÿéš›ãƒã‚°ã ã‘ã©ã“ã‚Œã§æƒ³å®šé€šã‚Šãªã‚“ã ã¨è¨€ã‚ã‚Œã¦ãŸï¼ˆHe told me that this was not, in fact, a bug, but was working as intended.ï¼‰ ã®ã§ãã†ã„ã†ã“ã¨ã ã£ãŸã¿ãŸã„ã§ã™ï¼Ž jQuery æœ¬ä½“å´ã®å¤‰é· jQuery ã® $() ã«ã¯è¤‡æ•°ã®
ama-ch 2013/11/20
jQuery

xss

security
ãƒªãƒ³ã‚¯
1 2 3 æ¬¡ã®ãƒšãƒ¼ã‚¸