ã€PoC編】XSSã¸ã®è€æ€§ã«ãŠã„ã¦ãƒ–ラウザã®ãƒ¡ãƒ¢ãƒªç©ºé–“æ–¹å¼ã¯Local Storageæ–¹å¼ã‚ˆã‚Šå®‰å…¨ã‹ï¼Ÿ - Flatt Security Blogã¯ã˜ã‚ã« ã“ã‚“ã«ã¡ã¯ã€‚ ã‚»ã‚ュリティエンジニアã®@okazu-dm ã§ã™ã€‚ ã“ã®è¨˜äº‹ã¯ã€Auth0ã®ã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³ã®ä¿å˜æ–¹æ³•ã«ã¤ã„ã¦è§£èª¬ã—ãŸå‰å›žã®è¨˜äº‹ã®è£œè¶³ã¨ãªã‚‹è¨˜äº‹ã§ã™ã€‚å‰å›žã®è¨˜äº‹ã®è¦æ—¨ã‚’ã–ã£ãã‚Šã¾ã¨ã‚ã‚‹ã¨ä»¥ä¸‹ã®ã‚ˆã†ãªã‚‚ã®ã§ã—ãŸã€‚ Auth0ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã¯ã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³ã‚’ブラウザã®ãƒ¡ãƒ¢ãƒªç©ºé–“上ã«ã®ã¿ä¿å˜ã™ã‚‹in-memoryæ–¹å¼ã§ã‚ã‚Šã€XSSã¸ã®è€æ€§ã®ãªã•ç‰ã®ç†ç”±ã§localStorageã§ä¿å˜ã™ã‚‹ã“ã¨ã‚’推奨ã—ã¦ã„ãªã„ ã—ã‹ã—ã€XSSã§ã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³ã‚’奪å–ã§ãã‚‹ã®ã¯in-memoryæ–¹å¼ã§ã‚‚åŒã˜ã®ã¯ãš(検証ã¯è¡Œã„ã¾ã›ã‚“ã§ã—ãŸ)。localStorageæ–¹å¼ã‚’éŽåº¦ã«å¿Œé¿ã™ã‚‹å¿…è¦ã¯ãªã„ã®ã§ã¯ãªã„ã‹ ãªãŠã€Flatt Securityã®æä¾›ã™ã‚‹ã‚»ã‚ュリティ診æ–ã¯Auth0ã«é™ã‚‰ãšFirebase Authenticationã‚„Amazon Cognitoãªã©ã®IDaaSã®ã‚»ã‚ュアãªåˆ©ç”¨
Choose between Formidable, Busboy, Multer and Multiparty for processing file uploads
JALã®ITãƒãƒ¼ãƒ ãŒè¦‹ã„ã ã—ãŸkintoneæˆåŠŸæ–¹ç¨‹å¼ã¯ã€Œç›®çš„ã€Ã—「仕組ã¿ã€Ã—「熱æ„ã€
ã¯ã¦ãªãƒ–ックマークアプリã§ãƒŸãƒ¥ãƒ¼ãƒˆæ©Ÿèƒ½ï¼ˆÎ²ï¼‰ã®æ供を開始ã—ã¾ã—㟠- ã¯ã¦ãªãƒ–ックマーク開発ブãƒã‚°
{{#tags}}- {{label}}
{{/tags}}