JSX
Toggle shortcuts help? Toggle "can call user code" annotationsu Jump to search box/ Draft / August 4, 2022JSX Introduction JSX is an XML-like syntax extension to ECMAScript without any defined semantics. It's NOT intended to be implemented by engines or browsers. It's NOT a proposal to incorporate JSX into the ECMAScript spec itself. It's intended to be used by various preprocessors (transpilers)
W3Cã®DTDã‚’å–ã‚Šã«è¡Œãã™ãŽã‚‹ã¨BANã•ã‚Œã‚‹ | 水無月ã°ã‘らã®ãˆã³æ—¥è¨˜
Yet we receive a surprisingly large number of requests for such resources: up to 130 million requests per day, with periods of sustained bandwidth usage of 350Mbps, for resources that haven't changed in years. W3Cã®ã‚µã‚¤ãƒˆã«ãŠã‹ã‚Œã¦ã„ã‚‹DTDãªã©ã«å¯¾ã—ã¦ã€1æ—¥ã«1å„„3åƒä¸‡å›žã»ã©ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒã‚ã‚‹ãã†ã§ã€‚ ãŸã¨ãˆã°ã€.NET Frameworkã®XmlDocumentã§XHTMLã‚’èªã‚€ãªã‚“ã¦ã‚·ãƒãƒ¥ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³ã¯ã‚ã‚ŠãŒã¡ã ã¨æ€ã„ã¾ã™ãŒã€XmlResolver = nullを指定ã›ãšã«ãã®ã¾ã¾ä½¿ã†ã¨ã€ã„ã¡ã„ã¡DTDã«ã‚¢ã‚¯ã‚»ã‚¹ã—ã«è¡Œã£ã¦ã—ã¾ã„ã¾ã™ã€‚世界ä¸ã§ãã†ã„ã†ã“ã¨ã‚’ã•ã‚Œã‚‹ã¨ã€ã¾ã‚ã€å¤§å¤‰ã§ã™
XMLã‚’Parseã™ã‚‹ã‚¢ãƒ—リã®ã‚»ã‚ュリティ（補足編） - teracc’s blog
以å‰ã®æ—¥è¨˜ã§ã¯ã€å¤–部ã‹ã‚‰ã®XMLをサーãƒã‚µã‚¤ãƒ‰ã§Parseã™ã‚‹ã‚¢ãƒ—リã¸ã®æ”»æ’ƒã®æ¦‚è¦ã«ã¤ã„ã¦æ›¸ãã¾ã—ãŸã€‚ 今日ã®æ—¥è¨˜ã§ã¯ã€ä½•ç‚¹ã‹è£œè¶³ã™ã‚‹äº‹é …ã«ã¤ã„ã¦æ›¸ãã¾ã™ã€‚ ファイルã®å†…容を盗ã¿å‡ºã™ä»–ã®æ–¹æ³• å‰ã®æ—¥è¨˜ã®ä¸ã§ã€ã‚µãƒ¼ãƒä¸Šã®ãƒ•ã‚¡ã‚¤ãƒ«ã®å†…容を外部ã‹ã‚‰ç›—ã¿å‡ºã™ã«ã¯ã„ãã¤ã‹ã®æ¡ä»¶ãŒã‚ã‚‹ã¨æ›¸ãã¾ã—ãŸã€‚ ãã®æ¡ä»¶ã®ã²ã¨ã¤ã«ã€Œã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®ã‚¹ã‚¿ã‚¤ãƒ«ã€ãŒã‚ã‚‹ã€å…·ä½“çš„ã«ã¯ã€ŒtextContentã€ã§è¦ç´ ã®å†…容をå–å¾—ã™ã‚‹ã‚¢ãƒ—リ（下ã®PHPコードã§ã¯Aã®ã‚¹ã‚¿ã‚¤ãƒ«ã®ã‚¢ãƒ—リ）ã§ã®ã¿ã€ã‚µãƒ¼ãƒä¸Šã®ãƒ•ã‚¡ã‚¤ãƒ«ã®å†…容を盗ã¾ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€ã¨æ›¸ãã¾ã—ãŸã€‚ <?php ... $elm = $doc->getElementsByTagName('test')->item(0); // A: 外部実体å‚ç…§ãŒå±•é–‹ã•ã‚Œã‚‹ $var = $elm->textContent; // B: 外部実体å‚ç…§ã¯å±•é–‹ã•ã‚Œãªã„ $var = $elm-
XMLã‚’parseã™ã‚‹ã‚¢ãƒ—リã®ã‚»ã‚ュリティ - 2009-06-21 - T.Teradaã®æ—¥è¨˜
「XMLã€ã€Œã‚»ã‚ュリティã€ã¨ã„ã†å˜èªžã§Web検索ã™ã‚‹ã¨ã€å¤šãヒットã™ã‚‹ã®ã¯XMLデジタル署åã‚„XMLæš—å·ãªã©ã‚’説明ã—ãŸWebページã§ã™ã€‚ 本日ã®æ—¥è¨˜ã§ã¯ã€ãã‚Œã¨ã¯ã¡ã‚‡ã£ã¨é•ã†ãƒ†ãƒ¼ãƒžï¼ˆXXEã¨å‘¼ã°ã‚Œã‚‹æ”»æ’ƒï¼‰ã«ã¤ã„ã¦æ›¸ãã¾ã™ã€‚ 脆弱ãªã‚³ãƒ¼ãƒ‰ã¨æ”»æ’ƒæ–¹æ³• ã•ã£ãã脆弱性ãŒã‚るサンプルプãƒã‚°ãƒ©ãƒ ã§ã™ã€‚ import java.io.*; import javax.servlet.*; import javax.servlet.http.*; import org.w3c.dom.*; import org.apache.xerces.parsers.*; import org.xml.sax.*; public class Test1 extends HttpServlet { public void service(HttpServletRequest request, HttpServletRe
Railsã®è„†å¼±æ€§: XML実体爆発攻撃 | 水無月ã°ã‘らã®ãˆã³æ—¥è¨˜
Railsã§XMLリクエストã®ãƒ‘ースã«ä½¿ç”¨ã•ã‚Œã¦ã„ã‚‹REXMLã«ã€DoS脆弱性ãŒç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚XML entity explosion attackã¨å‘¼ã°ã‚Œã‚‹æ”»æ’ƒæ‰‹æ³•ã«ã‚ˆã‚Šã€ãƒ¦ãƒ¼ã‚¶ã‹ã‚‰ä¸Žãˆã‚‰ã‚ŒãŸXMLを解æžã™ã‚‹ã‚ˆã†ãªã‚¢ãƒ—リケーションをサービスä¸èƒ½(DoS)状態ã«ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚大部分ã®Railsアプリケーションã¯ã“ã®æ”»æ’ƒã«å¯¾ã—ã¦è„†å¼±ã§ã™ã€‚ XML entity explosion attackã¨ã„ã†ã®ã¯ã€å®Ÿä½“宣言ã®ä¸ã§åˆ¥ã®å®Ÿä½“ã‚’å‚ç…§ã™ã‚‹ã“ã¨ã‚’ç¹°ã‚Šè¿”ã—ã¦å®Ÿä½“å‚ç…§ã®å‡¦ç†è² è·ã‚’高ã‚る手法ã®ã‚ˆã†ã§ã™ã。掲ã’られã¦ã„るサンプルコードã¯çŸã„ã§ã™ãŒã€å®Ÿä½“å‚照を展開ã™ã‚‹ã¨ãƒ‡ãƒ¼ã‚¿ã¯30メガãƒã‚¤ãƒˆã«ã‚‚ãªã‚Šã¾ã™ã€‚展開ã®å‡¦ç†æ–¹æ³•ã«ã‚ˆã£ã¦ã¯ã€ãƒ¡ãƒ¢ãƒªã‚’食ã„å°½ãã—ã¦ã—ã¾ã†ã®ã§ã—ょã†ã€‚ 外部ã‹ã‚‰XMLデータã®POSTã‚’å—ã‘付ã‘るよã†ãªã‚µã‚¤ãƒˆã¯æ³¨æ„……ã¨è¨€ã„ãŸã„ã¨ã“ã‚ã§ã™ãŒã€XMLデータã®POSTã‚’å—ã‘付ã‘ãªã„ã¯ãšã®
ECMAScript for XML (E4X) 仕様邦訳
ã“ã®æ–‡æ›¸ã¯ ECMA-357 ECMAScript for XML (E4X) Specification 2nd edition を訳者 (nanto_vi) ãŒç§çš„ã«è¨³ã—ãŸã‚‚ã®ã§ã‚ã‚Šã€Ecma International ã¾ãŸã¯ãã®ä»–ã®é–¢é€£å›£ä½“・個人ã¨ã¯ä¸€åˆ‡é–¢ä¿‚ã‚ã‚Šã¾ã›ã‚“。 ã“ã®æ–‡æ›¸ã¯æ£è¦ã®ä»•æ§˜ã§ã¯ã‚ã‚Šã¾ã›ã‚“。æ£è¦ã®ä»•æ§˜ã«é–¢ã—ã¦ã¯ Ecma International ã‹ã‚‰ PDF ã§å…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ 翻訳ã®å†…容ã«ã¤ã„ã¦ã¯ä¿éšœã—ã¾ã›ã‚“。ã“ã®æ–‡æ›¸ã®åˆ©ç”¨ã«ã‚ˆã£ã¦ç™ºç”Ÿã—ãŸã„ã‹ãªã‚‹æ害ã«ã¤ã„ã¦ã‚‚訳者ã¯è²¬ä»»ã‚’è² ã„ã¾ã›ã‚“。 翻訳上ã®èª¤ã‚Šãªã©ãŒã‚ã‚Œã°è¨³è€… (ブãƒã‚°ã¾ãŸã¯ãƒ¡ãƒ¼ãƒ« <nanto (at) moon.email.ne.jp>) ã¾ã§ã”連絡ãã ã•ã„。 Standard ECMA-357 2nd Edition / December 2005 åºæ–‡ 2002 å¹´ 6 月 13 æ—¥ã€BEA S
)
Using the XML Diff and Patch Tool in Your Applications
Neetu Rajpal Microsoft Corporation August 29, 2002 Download Xmldiffpatch.exe. Note The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, data, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, places, data, or events is intended or should be inferred. Su
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Chrome & Opera’s inbuilt ATOM/RSS reader with Script Execution
Stabsstelle Informationssicherheit (RUS-CERT) | Universität Stuttgart
http://www.asahi.com/xml/asahicom.xml
IBM Developer
{{#tags}}- {{label}}
{{/tags}}