[B! XSS][javascript] reponã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

repon id:repon

XSSã¨javascriptã«é–¢ã™ã‚‹reponã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

PHPã®ã‚¤ã‚¿ã„å…¥é–€æ›¸ã‚’èªã‚“ã§Ajaxã®XSSã«ã¤ã„ã¦æ¤œè¨Žã—ãŸ(3)ï½žJSONç‰ã®æƒ³å®šå¤–èªã¿å‡ºã—ã«ã‚ˆã‚‹æ”»æ’ƒï½ž - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜
æ˜¨æ—¥ã®æ—¥è¨˜ã®ç¶šãã§ã€Ajaxã«å›ºæœ‰ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦æ¤œè¨Žã—ã¾ã™ã€‚ä»Šå›žã¯JSONç‰ã®æƒ³å®šå¤–èªã¿å‡ºã—ã«ã‚ˆã‚‹æ”»æ’ƒã§ã™ã€‚ã“ã‚Œã‚‰æ”»æ’ƒæ‰‹æ³•ã¯æœ¬æ¥ãƒ–ãƒ©ã‚¦ã‚¶å´ã§å¯¾å¿œã™ã¹ãã‚‚ã®ã§ã€ã‚„ã‚€ã‚’å¾—ãšWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å´ã§å¯¾å¿œã™ã‚‹ä¸Šã§ã€ã¾ã å®šç•ªã¨ãªã‚‹å¯¾ç–ãŒãªã„ã‚ˆã†ã«æ€ãˆã¾ã™ã€‚ã“ã®ãŸã‚ã€è¤‡æ•°ã®å€™è£œã‚’ç¤ºã™ã‚‹ã“ã¨ã§è°è«–ã®ãã£ã‹ã‘ã«ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ã¾ãšã€ä½œã‚ŠãªãŒã‚‰åŸºç¤Žã‹ã‚‰å¦ã¶PHPã«ã‚ˆã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å…¥é–€XAMPP/jQuery/HTML5ã§ä½œã‚‹ã‚¤ãƒžãƒ‰ã‚ã®Weã‹ã‚‰ã€Ajaxã‚’åˆ©ç”¨ã—ãŸã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®æ¦‚å¿µå›³ã‚’å¼•ç”¨ã—ã¾ã™ï¼ˆåŒæ›¸P20ã®å›³1-23ï¼‰ã€‚ å‰å›žã€å‰ã€…å›žã¯ã€(5)ã®HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ã®å‰å¾Œã§ã€JSONç‰ã®ãƒ‡ãƒ¼ã‚¿ä½œæˆï¼ˆã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ï¼‰ã«èµ·å› ã™ã‚‹evalã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚„ã€(5)ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’å—ã‘å–ã£ãŸå¾Œã®HTMLãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã®éš›ã®XSSã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã—ãŸã€‚ ã—ã‹ã—ã€å•é¡Œã¯ã“ã‚Œã ã‘ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚æ£å¸¸
repon 2014/05/04
XSS

ajax

json

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript
ãƒªãƒ³ã‚¯
http://blog.monoweb.info/blog/2012/03/15/content-security-policy/
repon 2013/06/28
XSS

csp

javascript

security
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
repon 2011/08/09
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ•ã‚©ãƒ¼ãƒ

XSS

javascript

è³‡æ–™
ãƒªãƒ³ã‚¯
DOM APIã¨innerHTMLã¯ç‰ä¾¡ã§ã¯ãªã„
æœ€è¿‘ã€å¾³ä¸¸æœ¬ã‚’ã˜ã‚ã˜ã‚èªã‚“ã§ã„ã‚‹ã®ã§ã™ãŒã€DOM based XSSã®è©±ãŒæ›¸ã„ã¦ã‚ã£ãŸã®ã§ã€å°‘ã—è¨€åŠã—ã¦ãŠã“ã†ã¨æ€ã„ã¾ã™ã€‚ å¾³ä¸¸æœ¬ã‹ã‚‰å¼•ç”¨ DOM based XSSã¨å‘¼ã°ã‚Œã‚‹XSSãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã¯ã€JavaScriptã«ã‚ˆã‚Šã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´ã§è¡¨ç¤ºå‡¦ç†ã™ã‚‹ç®‡æ‰€ãŒã‚ã‚Šã€ãã“ã«è„†å¼±æ€§ãŒã‚ã‚‹å ´åˆã®XSSã§ã™ã€‚ ã‚µãƒ³ãƒ—ãƒ«æ›¸ã„ã¦ã¿ã¾ã—ãŸã€‚ <script> document.write(unescape(location.href)); </script> ã“ã„ã¤ã‚’é©å½“ãªãƒ•ã‚¡ã‚¤ãƒ«åã§ä¿å˜ã—ã¦ã€domxss.html#<script>alert("hello")<script>ãªã©ã®URLã§ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨alertãŒè¡¨ç¤ºã•ã‚Œã‚‹ã¯ãšã§ã™ã€‚ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œå¯èƒ½ãªçŠ¶æ…‹ã£ã¦ã“ã¨ã§ã™ãã€‚ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œå¯èƒ½ã£ã¦ã“ã¨ã¯ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¯ãƒƒã‚ãƒ¼ç›—ã¿æ”¾é¡Œã§ã€ä»–äººã«æˆã‚Šæ¸ˆã¾ã—ã¦è²·ã„ç‰©ã§ãã¡ã‚ƒã£ãŸã‚Šã™ã‚‹ãƒ¬ãƒ™ãƒ«ã§ã™
repon 2011/06/05
è³‡æ–™

dom

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

JavaScript

XSS

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°
ãƒªãƒ³ã‚¯
1