JSON and Browser Security
JSON is a data interchange format. It is used in the transmission of data between machines. Since it carries only data, it is security-neutral. The security of systems that use JSON is determined by the quality of the design of those systems. JSON itself introduces no vulnerabilities. The web browser is a peculiar application environment. The security model of the browser was forged through a long
JSONã®ã‚»ã‚ュリティã®ã€ç–‘å• - FAX
snippets from shinichitomita’s journal - クãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã§ã®ãƒ‡ãƒ¼ã‚¿èªã¿è¾¼ã¿ã‚’防æ¢ã™ã‚‹JavaScript ? æ±äº¬ã§èˆ˜é‡Žã«ã‚‚èžã„ãŸã‚“ã ã‘ã©ã€JSONã¨ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ãƒ‡ãƒ¼ã‚¿æ¼æ´©ã®å•é¡ŒãŒã‚ˆã分ã‹ã‚‰ãªã„。JSONã£ã¦ã€ãã‚‚ãã‚‚ã„ã‚ã‚“ãªæ‰€ã‹ã‚‰ä½¿ã£ã¦æ¬²ã—ã„ã‹ã‚‰JSONãªã‚“ã˜ã‚ƒãªã„ã®?裸ã§æˆ¦å ´ã§ç”Ÿã残るã«ã¯ã©ã†ã™ã‚Œã°ã‚ˆã„ã‹ã€â†æœç€ã‚よã€ã¿ãŸã„ãªã“ã¨ã«ãªã£ã¦ãªã„?外部ã‹ã‚‰èªã¾ã‚Œã‚‹ã¨ã¾ãšã„データã¯ã€ãƒãƒŠã‹ã‚‰JSONã˜ã‚ƒãªãゃã„ã„ã®ã«ã¨æ€ã†ã‚“ã ã‘ã©ã€‚ name : 'brasil', age : 30 } XHRã§å–ã£ã¦ã€è£œã£ã¦evalã™ã‚‹æ„Ÿã˜ã§ã€‚ ã§ã‚‚ã€ã™ã”ã„人ãŸã¡ã§è€ƒãˆã¦ã‚‹ã®ã§ã€ãã£ã¨åƒ•ã®è€ƒãˆé•ã„ãªã®ã‚‰ã€‚ 追記mala 『gmailã§ä½¿ã£ã¦ã‚‹JSONã¯å…ˆé ã«while(1)ãŒã¤ã„ã¦ã¦å¤–部ã§ä½¿ã†ã¨ãƒ–ラクラã«ãªã‚‹ã‚ˆã€ãã‚Œã€ãªã‚“ã¦ãƒã‚¤ã‚ºãƒ³ãƒ»ãƒ”ル? (w
Ajaxian » The safety of JSON
Enterprise Strategy Group: Go-to-market Expertise to Help You Win
steps to phantasien t(2007-01-03) ã„ã¤ã‚‚ã®æ´¾é–¥äº‰ã„ã®è©±
去年ã®æœªèª feed を消化ã—ã¦ã„ãŸã‚‰, XML vs JSON ã¨ã„ã†è©±ãŒãžã‚ãžã‚出ã¦ããŸ. ç«äº‹ã¨å–§å˜©ã¯ XML ã®è¯. 最近ã¡ã‚‡ã£ã¨ãŠã¨ãªã—ã‹ã£ãŸã‘ã‚Œã©, ãŸã¾ã«ã¯ã“ã†ã„ã†ã®ãŒãªã„ã¨å¯‚ã—ã„よã. ç«å…ƒã¯ JSON ã®è¦ªçŽ‰ã§ã‚ã‚‹ Douglas Crockford ㌠XML2007 ã§è¡Œã£ãŸè¬›æ¼” "JSON, The Fat-Free Alternative to XML" らã—ã„ (スライド㮠ppt) . XML 愛好家ã®é›†ã‚Šã§ XML ã§ãªã„フォーマットã®è©±ã‚’ã™ã‚‹ã¨ã¯è±ªèƒ†ã . ã—ã‹ã‚‚æš—ã« "ãŠã¾ã„らãŠã§ã¶ã¡ã‚ƒã‚“ã¨ã¯é•ã†ã‚“ã ãœ" ã¨ç…½ã£ã¦ã„ã‚‹ã‚ã‘ã ã‹ã‚‰, XML ファンãŒåˆºæ¿€ã•ã‚Œã‚‹ã®ã‚‚仕方ãªã„. ã¾ã¨ã‚記事ã«ã‚ˆã‚‹ã¨, åæ’ƒã®ç‹¼ç…™ã‚’上ã’ãŸã®ã¯ Scripting News らã—ã„. ã§ã‚‚èªã‚“ã§ã¿ã‚‹ã¨ã‚ã‚“ã¾ã— JSON ã‚’ã‚ã‹ã£ã¦ãªã„節ãŒã‚ã‚‹. 本人も自覚ãŒã‚ã‚‹ã®ã‹, è°è«–ã‚’ã†ãªãŒã—
JavaScriptã®ã‚½ãƒ¼ã‚¹ã«é‡è¦ãªãƒ‡ãƒ¼ã‚¿ã‚’埋ã‚込むãªã‚“ã¦â€¦.
(Last Updated On: 2007å¹´1月3æ—¥)Gmailã§JavaScriptã®ã‚½ãƒ¼ã‚¹ã¨ã—ã¦ã‚³ãƒ³ã‚¿ã‚¯ãƒˆãƒªã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã‚’埋ã‚込んã§ã„ãŸãŸã‚ã€ç¬¬ä¸‰è€…ãŒã‚³ãƒ³ã‚¿ã‚¯ãƒˆãƒªã‚¹ãƒˆã‚’ç›—ã‚ã¦ã—ã¾ã†ã€ã¨ã„ã†å•é¡ŒãŒè©±é¡Œã«ãªã£ã¦ã„ã¾ã™ã€‚ ã¾ã 詳ã—ã調ã¹ã¦ã„ã¾ã›ã‚“ãŒsrc属性ã«æŒ‡å®šã•ã‚ŒãŸã‚½ãƒ¼ã‚¹ã¯èª°ã§ã‚‚（ã©ã®ã‚µã‚¤ãƒˆã‹ã‚‰ã§ã‚‚）å–å¾—ã§ãるブラウザã®ä»•æ§˜ã‚’利用ã—ãŸã‚‚ã®ã ã¨æ€ã„ã¾ã™ã€‚ 比較的早ãã‹ã‚‰src属性ã§ä»–ã®ã‚µã‚¤ãƒˆã®JavaScritpãŒæŒ‡å®šã§ãる仕様ã®ãƒªã‚¹ã‚¯ã¯æŒ‡æ‘˜ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚Gmailã§ã•ãˆé‡è¦ãªãƒ‡ãƒ¼ã‚¿ã‚’JavaScriptã®ã‚½ãƒ¼ã‚¹ã«åŸ‹ã‚込んã§ã„ã‚‹ã®ã§ã™ã‹ã‚‰Ajaxアプリケーションã®å¤šãã«åŒã˜è„†å¼±æ€§ãŒã‚るよã†ãªæ°—ãŒã—ã¾ã™â€¦ 手ã£å–ã‚Šæ—©ãä¸å®Œå…¨ãªæ–¹æ³•ã§ä¿®æ£ã™ã‚‹ã«ã¯ãƒªãƒ•ã‚¡ãƒ©ãƒã‚§ãƒƒã‚¯ã€ãã¡ã‚“ã¨ä¿®æ£ã™ã‚‹ãªã‚‰JavaScriptã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã«éµã‚’付ã‘ã¦ãƒã‚§ãƒƒã‚¯ã™ã‚‹ã€ã¨ã„ã£ãŸæ–¹æ³•ã§å¯¾ç–å¯èƒ½ã§ã™ã€‚ http://exam
1
ランã‚ング
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
https://labs.cybozu.co.jp/blog/kazuho/archives/2007/01/jsonp-security.php
https://labs.cybozu.co.jp/blog/kazuho/archives/2007/01/cross-site_including.php
{{#tags}}- {{label}}
{{/tags}}