[B! html][security] issmã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

issm id:issm

htmlã¨securityã«é–¢ã™ã‚‹issmã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

CSRFå¯¾ç–ç”¨ãƒˆãƒ¼ã‚¯ãƒ³ã®å€¤ã«ã‚»ãƒƒã‚·ãƒ§ãƒ³IDãã®ã‚‚ã®ã‚’ä½¿ã£ã¦ã‚‚ã„ã„æ™‚ä»£ãªã‚“ã¦ã€ãã‚‚ãã‚‚ç„¡ã‹ã£ãŸ
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
issm 2014/02/20
security

csrf

http

session

cookie

html
ãƒªãƒ³ã‚¯
formã‚¿ã‚°ã‚’åˆ©ç”¨ã—ãŸtokenå¥ªå– - ma<s>atokinugawa's blog
ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®å®Ÿè¡Œã¯ã§ããªã„ï¼ˆXSSå¯¾ç–ã•ã‚Œã¦ã„ã‚‹ï¼‰ã—ã€tokenã¯å°Žå…¥ã•ã‚Œã¦ã„ã‚‹ï¼ˆCSRFå¯¾ç–ã•ã‚Œã¦ã„ã‚‹ï¼‰ã®ã«ã€tokenã‚’å¥ªå–ã•ã‚Œã€ä¸æœ¬æ„ãªæ“ä½œã‚’ã•ã‚Œã¦ã—ã¾ã†ä¾‹ã¨ã„ã†ã®ã‚’1ã¤ã€ã‚„ã£ã¦ã¿ãŸã„ã¨æ€ã„ã¾ã™ï¼ å®Ÿè¨¼ã ãƒ‹ãƒ£ãƒ³ï¼ http://d.hatena.ne.jp/kinugawamasanyan/20101012/nyan åŽŸç† ã“ã†ã„ã†ãƒ•ã‚©ãƒ¼ãƒ ãŒã‚ã£ãŸã‚‰ã€submitãƒœã‚¿ãƒ³ã‚’æŠ¼ä¸‹ã—ãŸæ™‚ã«tokenã®å€¤ãŒAã€Bã©ã£ã¡ã«ãƒã‚¹ãƒˆã•ã‚Œã‚‹ã§ã—ã‚‡ã†ã‹ã€‚ <form action="A" method="post"> <form action="B" method="post"> <input type="hidden" name="token" value="123123123"> <input type="submit"> </form> ç”ãˆã¯Aã§ã™ã€‚ ã¤ã¾ã‚Šæœ¬æ¥è¨ç½®ã•ã‚ŒãŸãƒ•ã‚©ãƒ¼ãƒ ã‚ˆã‚Šå‰ã«åˆ¥ã®f
issm 2014/02/20
html

form

csrf

security
ãƒªãƒ³ã‚¯
Kazuho@Cybozu Labs: (Twitter ã® XSS è„†å¼±æ€§ã«é–¢é€£ã—ã¦) æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®æ£ã—ã„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦
æ˜¨æ—¥ã® Twitter ã® XSS é¨’ãŽã¯ã€ã¾ã çš†ã•ã‚“ã®è¨˜æ†¶ã«æ–°ã—ã„ã“ã¨ã¨æ€ã„ã¾ã™ã€‚ã„ã„æ©Ÿä¼šãªã®ã§ã€ãƒ„ã‚¤ãƒ¼ãƒˆã®ã‚ˆã†ãªæ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦è§¦ã‚Œã¦ãŠããŸã„ã¨æ€ã„ã¾ã™ã€‚ Twitter ã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã¯ã€å˜ãªã‚‹å¹³æ–‡ï¼ˆãƒ—ãƒ¬ã‚¤ãƒ³ãƒ†ã‚ã‚¹ãƒˆï¼‰ã§ã¯ãªãã€ã€Œ@è‹±æ•°å—ã€ã®ã‚ˆã†ãªä»–ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¸ã®è¨€åŠã¨ã€Œhttp://ã€œã€ã®ã‚ˆã†ãª URL ã‚’è‡ªå‹•çš„ã«ãƒã‚¤ãƒ‘ãƒ¼ãƒªãƒ³ã‚¯åŒ–ã™ã‚‹æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã§ã™ã€‚ ã“ã®ã‚ˆã†ãªè¤‡æ•°ã®ãƒ«ãƒ¼ãƒ«ã‚’ã‚‚ã¤æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã‚’ HTML åŒ–ã™ã‚‹éš›ã«ã¯ã€ã©ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã‚’æ›¸ã‘ã°ã„ã„ã®ã§ã—ã‚‡ã†ï¼Ÿã€€ã¾ãšã€Œ@ã€œã€ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ã¦ã‹ã‚‰ã€URL ã‚’ãƒªãƒ³ã‚¯åŒ–ã™ã‚Œã°ã„ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿã€€ãã‚Œã ã¨ã€@ã€œ ã®ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ãŸ A HREF ã‚¿ã‚°ã®ä¸ã® URL ãŒã•ã‚‰ã«ãƒªãƒ³ã‚¯åŒ–ã•ã‚Œã¦ã„ã¾ã„ã¾ã™ãã€‚ ã§ã¯ã€URL ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ã¦ã‹ã‚‰ @ã€œ ã‚’ãƒªãƒ³ã‚¯åŒ–ã™ã‚Œã°ã„ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿã€€ãã‚Œã ã¨ã€@ ã‚’å«ã‚€ URL ãŒã‚ã£ãŸå ´åˆã«
issm 2010/09/22
kazuho

xss

security

html

perl

text
ãƒªãƒ³ã‚¯
æ•™ç§‘æ›¸ã«è¼‰ã‚‰ãªã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ç¬¬1å›ž ï¼»ã“ã‚Œã¯ã²ã©ã„ï¼½IEã®å¼•ç”¨ç¬¦ã®è§£é‡ˆ âˆ’ ï¼ IT
XSSã«CSRFã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«â€¦â€¦Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãƒ—ãƒã‚°ãƒ©ãƒžãŒçŸ¥ã£ã¦ãŠãã¹ãè„†å¼±æ€§ã¯ã„ã£ã±ã„ã‚ã‚Šã¾ã™ã€‚ãã“ã§æœ¬é€£è¼‰ã§ã¯ã€ãã®ã‚ˆã†ãªãƒ¡ã‚¸ãƒ£ãƒ¼ãªã‚‚ã®â€œä»¥å¤–â€ã‚‚æŽ˜ã‚Šä¸‹ã’ã¦ã„ãã¾ã™ï¼ˆç·¨é›†éƒ¨ï¼‰ å°ã•ãªè©±é¡ŒãŒé¢ç™½ã„ çš†ã•ã‚“ã€ã¯ã˜ã‚ã¾ã—ã¦ã€‚ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ã¨ç”³ã—ã¾ã™ã€‚ ã€Œæ•™ç§‘æ›¸ã«è¼‰ã‚‰ãªã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã¨ã„ã†ã“ã¨ã§ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢é€£ã™ã‚‹ã€æ™®æ®µã‚ã¾ã‚Šè¦‹æŽ›ã‘ãªã„ã‚ˆã†ãªå°ã•ãªè©±é¡Œã‚’å–ã‚Šä¸Šã’ã¦ã„ããŸã„ã¨æ€ã„ã¾ã™ã€‚ ã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’å®Ÿç¾ã™ã‚‹ãŸã‚ã«ã€é–‹ç™ºè€…ã®æ–¹ã ã‘ã§ãªãã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§æ¤œæŸ»ã‚’è¡Œã†æ–¹ã€…ã«ã‚‚èªã‚“ã§ã„ãŸã ããŸã„ã¨æ€ã£ã¦ã„ã¾ã™ã€‚é‡ç®±ã®éš…ã‚’æ¥Šæžã§ã»ã˜ãã‚‹ã‚ˆã†ãªå°ã•ãªè©±é¡Œã°ã‹ã‚Šã§ã™ãŒã€çš†ã•ã‚“ã‚ˆã‚ã—ããŠé¡˜ã„ã—ã¾ã™ã€‚ ã•ã¦ç¬¬1å›žã¯ã€Internet ExplorerãŒHTMLã‚’è§£é‡ˆã™ã‚‹éš›ã®å¼•ç”¨
issm 2009/03/02
security

html

browser

ie

javascript

xss
ãƒªãƒ³ã‚¯
JavaScriptç„¡ã—ã§ãƒ•ã‚©ãƒ¼ãƒ ã‚’ã‚³ãƒ³ãƒˆãƒãƒ¼ãƒ«
(Last Updated On: )è¨€ã‚ã‚Œã¦ã¿ã‚Œã°ã€ãã†è¨€ãˆã°ãã‚“ãªæ©Ÿèƒ½ãŒã‚ã£ãŸãã€ã¨æ€ã†ã‚ˆã†ãªæ©Ÿèƒ½ã¯ã‚ˆãã‚ã‚Šã¾ã™ã€‚ JavaScriptç„¡ã—ã§ãƒ•ã‚©ãƒ¼ãƒ ã‚’åˆ¶å¾¡ã™ã‚‹æ–¹æ³•ã¯HTML4ãŒç–å®šã•ã‚Œã¦ã„ã‚‹æ™‚ã«è¿½åŠ ã•ã‚ŒãŸæ©Ÿèƒ½ã§ã™ã€‚ http://www.w3.org/TR/html401/interact/forms.html#h-17.2.1 ä»¥ä¸‹ã®LABELã‚¿ã‚°ã®ã‚µãƒ³ãƒ—ãƒ«ã¯ http://www.0x000000.com/?i=635 ã‚ˆã‚Šæ‹å€Ÿã—ã¦ã„ã¾ã™ã€‚ <label for="action"> <body> Etymology of "Foo" 1 April 2001 When used in connection with `bar' it is generally traced to the WW II era Army slang acronym FUBAR (`Fucked Up
issm 2008/09/03
html

form

security
ãƒªãƒ³ã‚¯
labelè¦ç´ ã§ãƒ•ã‚©ãƒ¼ãƒ ã‚’åˆ¶å¾¡ã£ã¦â€¦â€¦ | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
è¨€ã‚ã‚Œã¦ã¿ã‚Œã°ã€ãã†è¨€ãˆã°ãã‚“ãªæ©Ÿèƒ½ãŒã‚ã£ãŸãã€ã¨æ€ã†ã‚ˆã†ãªæ©Ÿèƒ½ã¯ã‚ˆãã‚ã‚Šã¾ã™ã€‚ JavaScriptç„¡ã—ã§ãƒ•ã‚©ãƒ¼ãƒ ã‚’åˆ¶å¾¡ã™ã‚‹æ–¹æ³•ã¯HTML4ãŒç–å®šã•ã‚Œã¦ã„ã‚‹æ™‚ã«è¿½åŠ ã•ã‚ŒãŸæ©Ÿèƒ½ã§ã™ã€‚ â€¦â€¦æœ€åˆã¯ã¾ã£ãŸãæ„å‘³ãŒåˆ†ã‹ã‚‰ãªã‹ã£ãŸã®ã§ã™ãŒã€ã“ã‚Œã€labelè¦ç´ ã®è©±ã§ã™ã‹!? labelè¦ç´ ãŒã€Œè¨€ã‚ã‚Œã¦ã¿ã‚Œã°ã€ãã†è¨€ãˆã°ãã‚“ãªæ©Ÿèƒ½ãŒã‚ã£ãŸãã€ã¨æ€ã†ã‚ˆã†ãªæ©Ÿèƒ½ã€ã§ã‚ã‚Šã€ã€ŒJavaScriptç„¡ã—ã§ãƒ•ã‚©ãƒ¼ãƒ ã‚’åˆ¶å¾¡ã™ã‚‹æ–¹æ³•ã€ã§ã‚ã‚‹ã€ã¨ã„ã†ã®ã¯æƒ³åƒã‚’çµ¶ã—ã¦ã„ã¾ã—ãŸã€‚å°‘ãªãã¨ã‚‚ã€Webå±‹ã§ã¯çµ¶å¯¾ã«è€ƒãˆã‚‰ã‚Œãªã„ç™ºè¨€ã§ã™ãã€‚ä»Šä¸–ç´€ã«å…¥ã£ã¦ã‹ã‚‰ä½œã‚‰ã‚ŒãŸãƒ•ã‚©ãƒ¼ãƒ ã§ã¯ã€labelè¦ç´ ãŒä½¿ã‚ã‚Œã¦ã„ãªã„ã‚‚ã®ã®æ–¹ãŒçã—ã„ã®ã§ã¯ãªã„ã‹ã¨æ€ã„ã¾ã™ãŒâ€¦â€¦ã€‚ â€»ã¾ã¨ã‚‚ã«WCAGãªã©ã‚’èªã‚“ã§ã„ã‚‹äººãŒä½œã‚‹å ´åˆã¯ã€ã¨ã„ã†é™å®šãŒã¤ãã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€‚ ãªã‚“ã¨ã„ã†ã‹ã€ä½ã‚“ã§ã„ã‚‹ä¸–ç•ŒãŒé•ã†ã®ã‹ãªãã€‚ â€¦â€¦ã¡ãªã¿ã«ã€labelè¦ç´ ã‚’ä½¿ã‚ãªãã¦ã‚‚ã€
issm 2008/09/03
html

form

security
ãƒªãƒ³ã‚¯
1