[B! security][javascript] isdyyã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

isdyy id:isdyy

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (9)

ã‚¿ã‚°ã®çµžã‚Šè¾¼ã¿ã‚’è§£é™¤

securityã¨javascriptã«é–¢ã™ã‚‹isdyyã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
isdyy 2010/02/23
security

javascript
ãƒªãƒ³ã‚¯
JavaScriptã‚’ä½¿ã£ã¦ã‚¤ãƒ³ãƒˆãƒ©ãƒãƒƒãƒˆå†…ã‚’å¤–ã‹ã‚‰æ”»æ’ƒã™ã‚‹æ–¹æ³•:Geekãªãºãƒ¼ã˜
ã€ŒHacking Intranet Websites from the Outsideã€ã¨ã„ã†è¬›æ¼”ãŒ2006å¹´ã«ã‚ã‚Šã¾ã—ãŸã€‚ Black Hatã§ã®è¬›æ¼”ã§ã™ã€‚ ä»¥ä¸‹ã«èª¬æ˜Žã™ã‚‹æ‰‹æ³•ã¯æ—¢ã«å…¬é–‹ã•ã‚Œã¦ã‚ã‚‹ç¨‹åº¦æ™‚é–“ãŒçµŒéŽã—ã¦ã„ã‚‹æƒ…å ±ãªã®ã§ã€ã”å˜çŸ¥ã®æ–¹ã«ã¨ã£ã¦ã¯æ—¢ã«å¤ã„ã¨ã¯æ€ã„ã¾ã™ã€‚ è©³ç´°ã¯ãƒ—ãƒ¬ã‚¼ãƒ³è³‡æ–™ã‚’ã”è¦§ä¸‹ã•ã„ã€‚ æ¦‚è¦ ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ãªã©ã«å®ˆã‚‰ã‚ŒãŸã‚¤ãƒ³ãƒˆãƒ©ãƒãƒƒãƒˆã‚„ãƒ›ãƒ¼ãƒ ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã®å†…éƒ¨ã‚’æ”»æ’ƒã™ã‚‹æ‰‹æ³•ãŒè§£èª¬ã—ã¦ã‚ã‚Šã¾ã—ãŸã€‚ JavaScriptã®åŸºæœ¬ä»•æ§˜ã‚’çµ„ã¿åˆã‚ã›ã¦æƒ…å ±ã‚’åŽé›†ã™ã‚‹ã¨ã„ã†ã‚‚ã®ã§ã—ãŸã€‚ æœ€çµ‚çš„ã«ã¯ã€ãƒ—ãƒªãƒ³ã‚¿ã‹ã‚‰å°åˆ·ã‚’è¡Œã£ãŸã‚Šã€ãƒ«ãƒ¼ã‚¿ã®è¨å®šã‚’å¤‰æ›´ã™ã‚‹ãªã©ã®æ”»æ’ƒãŒå¯èƒ½ã«ãªã‚‹ã‚ˆã†ã§ã™ã€‚ ãã‚Œä»¥å¤–ã«ã‚‚ã€WebçµŒç”±ã§è¨å®šå¤‰æ›´ãŒå‡ºæ¥ã‚‹ã‚‚ã®ã¯çŠ¶æ³ã«ã‚ˆã£ã¦ã¯å½±éŸ¿ã•ã‚Œã‚‹ã‹ã‚‚çŸ¥ã‚Œã¾ã›ã‚“ã€‚ ãƒ—ãƒ¬ã‚¼ãƒ³å¾ŒåŠã§ã¯CSRF(XSRF, cross-site request forgery)ã‚‚è§£èª¬ã•ã‚Œã¦ã„ã¾ã—ãŸ
isdyy 2008/05/08
javascript

security
ãƒªãƒ³ã‚¯
Untitled
Database Not Connected. Please setup the database. No SETUP directory found.
isdyy 2007/03/07
security

javascript

html

tips
ãƒªãƒ³ã‚¯
https://labs.cybozu.co.jp/blog/kazuho/archives/2007/01/jsonp-security.php
isdyy 2007/01/14
JSON

JSONP

javascript

security

XSS
ãƒªãƒ³ã‚¯
https://labs.cybozu.co.jp/blog/kazuho/archives/2007/01/e4x-xss.php
isdyy 2007/01/11
javascript

security

e4x
ãƒªãƒ³ã‚¯
JavaScriptã®ã‚½ãƒ¼ã‚¹ã«é‡è¦ãªãƒ‡ãƒ¼ã‚¿ã‚’åŸ‹ã‚è¾¼ã‚€ãªã‚“ã¦â€¦.
(Last Updated On: 2007å¹´1æœˆ3æ—¥)Gmailã§JavaScriptã®ã‚½ãƒ¼ã‚¹ã¨ã—ã¦ã‚³ãƒ³ã‚¿ã‚¯ãƒˆãƒªã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã‚’åŸ‹ã‚è¾¼ã‚“ã§ã„ãŸãŸã‚ã€ç¬¬ä¸‰è€…ãŒã‚³ãƒ³ã‚¿ã‚¯ãƒˆãƒªã‚¹ãƒˆã‚’ç›—ã‚ã¦ã—ã¾ã†ã€ã¨ã„ã†å•é¡ŒãŒè©±é¡Œã«ãªã£ã¦ã„ã¾ã™ã€‚ ã¾ã è©³ã—ãèª¿ã¹ã¦ã„ã¾ã›ã‚“ãŒsrcå±žæ€§ã«æŒ‡å®šã•ã‚ŒãŸã‚½ãƒ¼ã‚¹ã¯èª°ã§ã‚‚ï¼ˆã©ã®ã‚µã‚¤ãƒˆã‹ã‚‰ã§ã‚‚ï¼‰å–å¾—ã§ãã‚‹ãƒ–ãƒ©ã‚¦ã‚¶ã®ä»•æ§˜ã‚’åˆ©ç”¨ã—ãŸã‚‚ã®ã ã¨æ€ã„ã¾ã™ã€‚ æ¯”è¼ƒçš„æ—©ãã‹ã‚‰srcå±žæ€§ã§ä»–ã®ã‚µã‚¤ãƒˆã®JavaScritpãŒæŒ‡å®šã§ãã‚‹ä»•æ§˜ã®ãƒªã‚¹ã‚¯ã¯æŒ‡æ‘˜ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚Gmailã§ã•ãˆé‡è¦ãªãƒ‡ãƒ¼ã‚¿ã‚’JavaScriptã®ã‚½ãƒ¼ã‚¹ã«åŸ‹ã‚è¾¼ã‚“ã§ã„ã‚‹ã®ã§ã™ã‹ã‚‰Ajaxã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®å¤šãã«åŒã˜è„†å¼±æ€§ãŒã‚ã‚‹ã‚ˆã†ãªæ°—ãŒã—ã¾ã™â€¦ æ‰‹ã£å–ã‚Šæ—©ãä¸å®Œå…¨ãªæ–¹æ³•ã§ä¿®æ£ã™ã‚‹ã«ã¯ãƒªãƒ•ã‚¡ãƒ©ãƒã‚§ãƒƒã‚¯ã€ãã¡ã‚“ã¨ä¿®æ£ã™ã‚‹ãªã‚‰JavaScriptã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã«éµã‚’ä»˜ã‘ã¦ãƒã‚§ãƒƒã‚¯ã™ã‚‹ã€ã¨ã„ã£ãŸæ–¹æ³•ã§å¯¾ç–å¯èƒ½ã§ã™ã€‚ http://exam
isdyy 2007/01/07
javascript

security

json

google

gmail
ãƒªãƒ³ã‚¯
1