[B! TIPS][xss] beth321ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

beth321 id:beth321

TIPSã¨xssã«é–¢ã™ã‚‹beth321ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ç¬¬8å›žã€€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°å¯¾ç–ã®è½ã¨ã—ç©´ | gihyo.jp
ä»Šå›žã¯ç†Ÿç·´ã—ãŸWebã‚¢ãƒ—ãƒªé–‹ç™ºè€…ãªã‚‰å¸¸è˜ã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°å¯¾ç–ã®è½ã¨ã—ç©´ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ JavaScriptã‚’æŽ’é™¤ã—ã¦ã„ã‚‹ã¤ã‚‚ã‚Šã§æŽ’é™¤ã«å¤±æ•—ï¼Ÿï¼ æœ€è¿‘ã¯Sanitizeï¼ˆã‚µãƒ‹ã‚¿ã‚¤ã‚ºï¼‰ã¨ã„ã†è¨€è‘‰ã®ä»£ã‚ã‚Šã«Validationï¼ˆæ¤œè¨¼ï¼‰ã¨ã„ã†è¨€è‘‰ã‚’ã‚ˆãèžãã‚ˆã†ã«ãªã£ãŸã¨æ€ã„ã¾ã™ã€‚Sanitizeã®æ„å‘³ã‚’è¾žæ›¸ã§èª¿ã¹ã‚‹ã¨ã€Œæ±šã‚Œã¦ã„ã‚‹ç‰©ã‚’ãã‚Œã„ã«ã™ã‚‹ã“ã¨ã€ã¨ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®æ„å‘³ã®é€šã‚Šæ±šã‚ŒãŸå¤‰æ•°ã‚’ãã‚Œã„ã«ã—ã¦ä½¿ãˆã°å®‰å…¨ã«åˆ©ç”¨ã§ãã‚‹ã¨ã™ã‚‹è€ƒãˆæ–¹ã«åŸºã¥ãã®ãŒã‚µãƒ‹ã‚¿ã‚¤ã‚ºæ‰‹æ³•ã§ã™ã€‚å…¸åž‹çš„ãªä¾‹ã¯ã€ã€Œâ ãƒ†ã‚ã‚¹ãƒˆã‚’å‡ºåŠ›ã™ã‚‹å‰ã«"<"ã¨">"ã‚’å–ã‚Šé™¤ãã€æ–¹æ³•ãŒã‚ã‚Šã¾ã™ã€‚ ä¾‹1ã€€"<"ã¨">"ã‚’ereg_replaceã§å–ã‚Šé™¤ã $safe_text = ereg_replace($_GET['text'], '[<>]', ''); ã“ã®$safe_textã‚’ <a href="/script.php?t
beth321 2014/10/16
php

*php

security

xss

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

web

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

dev

tips
ãƒªãƒ³ã‚¯
ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å…¥é–€ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
beth321 2014/09/22
ruby

c

PHP

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

XSS

ã‚ã¨ã§èªã‚€

web

tips

Qiita
ãƒªãƒ³ã‚¯
ç¬¬11å›žã€€ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’é˜²ã10ã®Tips | gihyo.jp
å‰å›žã¯ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãŒãªããªã‚‰ãªã„ç†ç”±ã‚’ç´¹ä»‹ã—ã¾ã—ãŸã€‚ãã‚Œã‚’ãµã¾ãˆã¦ä»Šå›žã¯ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’é˜²ã10ã®Tipsã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’æŒ‡å®š php.iniã«ã¯ã€PHPãŒç”Ÿæˆã—ãŸå‡ºåŠ›ã®æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’HTTPãƒ˜ãƒƒãƒ€ã§æŒ‡å®šã™ã‚‹default_charsetã‚ªãƒ—ã‚·ãƒ§ãƒ³ãŒã‚ã‚Šã¾ã™ã€‚æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã¯å¿…ãšHTTPãƒ˜ãƒƒãƒ€ãƒ¬ãƒ™ãƒ«ã§æŒ‡å®šã—ãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“ã€‚ã—ã‹ã—ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆè¨å®šã§ã¯default_charsetãŒç©ºã®çŠ¶æ…‹ã§ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§è¨å®šã—ãªã‘ã‚Œã°ã€HTTPãƒ˜ãƒƒãƒ€ã§ã¯æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒæŒ‡å®šã•ã‚Œãªã„çŠ¶æ…‹ã«ãªã‚Šã¾ã™ã€‚ HTTPãƒ˜ãƒƒãƒ€ã§æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’æŒ‡å®šã—ãªã„å ´åˆã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«è„†å¼±ã«ãªã‚‹å ´åˆã‚ã‚‹ã®ã§ã€default_charsetã«ã¯â€œâ UTF-8â â€ã‚’æŒ‡å®šã™ã‚‹ã“ã¨ã‚’ãŠå‹§ã‚ã—ã¾ã™ã€‚ã‚µã‚¤ãƒˆã«ã‚ˆã£ã¦ã¯SJISã€EUC-JP
beth321 2014/09/16
ã‚ã¨ã§

PHP

security

ã‚ã¨ã§èªã‚€

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss

programming

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

tips

web
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
beth321 2012/07/10
JavaScript

security

XSS

cookie

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

web

ã‚ã¨ã§èªã‚€

development

tips

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°
ãƒªãƒ³ã‚¯
JavaScriptå¤‰æ…‹æ–‡æ³•æœ€é€Ÿãƒžã‚¹ã‚¿ãƒ¼ - è‘‰ã£ã±æ—¥è¨˜
Javaå¤‰æ…‹æ–‡æ³•æœ€é€Ÿãƒžã‚¹ã‚¿ãƒ¼ - ãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã®è„³ã¿ãã‚’ãƒªã‚¹ãƒšã‚¯ãƒˆã€‚ JavaScriptã®å¤‰æ…‹æ–‡æ³•ãƒ»æŠ€æ³•ä¸€è¦§ã§ã™ã€‚ã‚ã‚“ã¾ã‚Šä½¿ã‚ãªã„ã‘ã©ã€çŸ¥ã£ã¦ã‚‹ã¨XSSã¨ã‹æ”»æ’ƒã—ãŸã„ã®ã«WAFã«å¦¨å®³ã•ã‚Œã‚‹ãªã©ã€ã„ã‚ã„ã‚åˆ¶ç´„ãŒã‚ã‚‹ã¨ã„ã†å ´åˆã«ä¾¿åˆ©ã€‚ æ–‡å—åˆ—ã®ç”Ÿæˆ å¼•ç”¨ç¬¦ã‚’ä½¿ã‚ãšã«ã•ãã£ã¨æ–‡å—åˆ—ã‚’ä½œã‚‹ã€‚fromCharCode ã¨ã‹ä½¿ã£ã¦ã‚‚ã„ã„ã‘ã©ã‚ã‚“ã©ãã•ã„ã®ã§ã€æ£è¦è¡¨ç¾ã‚„E4Xã‚’åˆ©ç”¨ã€‚ alert( /string/.source ); alert( <>string</> ) ç©ºç™½æ–‡å—ã‚’ä½¿ã‚ãšè¨˜è¿° æ–‡è„ˆä¸Šã€ã‚¹ãƒšãƒ¼ã‚¹ã‚’æ›¸ããŸã„ã‘ã‚Œã©ã„ã‚ã„ã‚åˆ¶ç´„ãŒã‚ã£ã¦æ›¸ã‘ãªã„å ´åˆã«ã¯ã‚³ãƒ¡ãƒ³ãƒˆã§ä»£æ›¿ã€‚å®Ÿè¡Œã™ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’ä½œã‚Šä¸Šã’ã¦evalã—ã¦ã‚‚ã„ã„ã‘ã©å¤§è¢ˆè£Ÿãªã®ã§ã€‚ var/**/x=1; */ ã‚’å«ã‚€ã‚³ãƒ¼ãƒ‰ãƒ–ãƒãƒƒã‚¯ã‚’ã‚³ãƒ¡ãƒ³ãƒˆã‚¢ã‚¦ãƒˆ ã‚³ãƒ¼ãƒ‰ã®å¡Šã‚Šã‚’ã‚³ãƒ¡ãƒ³ãƒˆã‚¢ã‚¦ãƒˆã—ã‚ˆã†ã¨æ€ã£ã¦ /* */ ã§å›²ã‚€ã¨ã€ã‚³ãƒ¼ãƒ‰å†…ã« string.
beth321 2012/05/04
**

javascript

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

ã¾ã¨ã‚

programming

security

tips

xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

å¤‰æ…‹
ãƒªãƒ³ã‚¯
PHP ã¨ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢
ã“ã®ãƒšãƒ¼ã‚¸ã«ã¤ã„ã¦ã®èª¬æ˜Žãƒ»æ³¨æ„ãªã© PHP ã¯ã€Apache ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚„ã€CGIã€ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã¨ã—ã¦ä½¿ç”¨ã§ãã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆè¨€èªžã§ã™ã€‚ã“ã®ãƒšãƒ¼ã‚¸ã§ã¯ã€ä¸»ã« PHP ã«ãŠã‘ã‚‹ã€Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã„ã¾ã™ã€‚ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã¨ã—ã¦ã¯ã€ä»¥ä¸‹ã®å•é¡Œã«ã¤ã„ã¦ã‚ˆãå–ã‚ŠæŒ™ã’ã‚‰ã‚Œã¦ã„ã‚‹ã¨æ€ã„ã¾ã™ãŒã€ã“ã‚Œã‚‰ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦èª¿ã¹ãŸã“ã¨ã‚„ã€ã“ã‚Œã‚‰ä»¥å¤–ã§ã‚‚ã€PHP ã«é–¢é€£ã—ã¦ã„ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦çŸ¥ã£ã¦ã„ã‚‹ã“ã¨ã«ã¤ã„ã¦ãƒ¡ãƒ¢ã—ã¦ãŠãã¾ã™ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ãƒ‘ã‚¹ãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«) ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã¾ãŸã€PHP ãƒžãƒ‹ãƒ¥ã‚¢ãƒ« : ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚„ã€PHP Security Guide (PHP Security Consortium) ã«ã¯ã€PH
beth321 2012/05/01
PHP

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

programming

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

ã¾ã¨ã‚

Web

XSS

tips

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
1