[B! escape] terkelã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

terkel id:terkel

escapeã«é–¢ã™ã‚‹terkelã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒ†ã‚ã‚¹ãƒˆã‚’CSSç”¨ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ãƒ„ãƒ¼ãƒ«ã‚’ä½œã£ã¦ã¿ãŸ
ãƒ†ã‚ã‚¹ãƒˆã‚’CSSç”¨ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ãƒ„ãƒ¼ãƒ«ã‚’ä½œã£ãŸã®ã§ã€ä¸€å¿œç´¹ä»‹ã—ã¦ãŠãã¾ã™ã€‚ CSSã®contentãƒ—ãƒãƒ‘ãƒ†ã‚£ãªã©ã§ãƒ†ã‚ã‚¹ãƒˆã‚’æ›¸ãã¨ããªã©ã€ãã®ã¾ã¾æ›¸ã„ã¦ã‚‚ã„ã„ã®ã§ã™ãŒã€æ—¥æœ¬èªžãªã©ã®å ´åˆã¯æ–‡å—ã‚³ãƒ¼ãƒ‰ãŒé¢å€’ãã•ã„ã®ã§ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ãŸæ–‡å—åˆ—ã‚’å…¥ã‚Œã¦ãŠãã¨ä¾¿åˆ©ã ã¨æ€ã£ã¦ã„ã¾ã™ã€‚ font-familyã®æŒ‡å®šã¨ã‹ã«ä½¿ã†ã“ã¨ã‚‚ã‚ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ ã“ã®è¾ºã®è©±ã¯WebTecNoteã•ã‚“ã®ã€Œ[css] contentãƒ—ãƒãƒ‘ãƒ†ã‚£ã§æŒ¿å…¥ã§ãã‚‹ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã€ã¨ã„ã†è¨˜äº‹ãŒåˆ†ã‹ã‚Šã‚„ã™ã„ã§ã™ã€‚ ã§ã€ä¸Šè¨˜ãƒªãƒ³ã‚¯å…ˆã«ã‚‚ä»Šå›žä½œã£ãŸã‚‚ã®ã¨ä¼¼ãŸã‚ˆã†ãªå¤‰æ›æ©ŸãŒã‚ã£ã¦ã€ä»¥å‰ã¯ã‚ˆãä½¿ã‚ã›ã¦ã‚‚ã‚‰ã£ã¦ã„ãŸã®ã§ã™ãŒã€ä½•ã¨è¨€ã†ã‹ã€ç·´ç¿’ã‚‚å…¼ãã¦è‡ªåˆ†ã§ä½œã£ã¦ã¿ãŸã„ã¨æ€ã£ãŸã‚ã‘ã§ã™ã€‚ ã¾ã‚è‡ªåˆ†ãªã‚Šã«ä½¿ã„ã‚„ã™ã„ã‚‚ã®ãŒã§ããŸã‹ã¨æ€ã„ã¾ã™ã€‚ Text Escaping for CSS ä½¿ã„æ–¹ã¯ä¸Šã®ãƒ†ã‚ã‚¹ãƒˆã‚¨ãƒªã‚¢ã«å¥½ããªæ–‡å—åˆ—ã‚’å…¥ã‚Œã‚‹ã ã‘ã§ã™ã€‚ ã‚ã€æ”¹è¡Œã‚‚
terkel 2011/10/03
css

content

escape
ãƒªãƒ³ã‚¯
JavaScriptï¼šunescapeHTMLã®å¦¥å½“ãªå®Ÿè£…
JavaScriptã«ã¯HTMLã‚’å®Ÿä½“å‚ç…§åŒ–ã™ã‚‹é–¢æ•°ã€PHPã§è¨€ã†ã¨ã“ã‚ã®htmlspecialchars()ã«ã‚ãŸã‚‹é–¢æ•°ãŒå˜åœ¨ã—ã¾ã›ã‚“ã€‚ æ£å¼ãªç†ç”±ã¯ã‚ˆãçŸ¥ã‚Šã¾ã›ã‚“ãŒã€æ•™ç§‘æ›¸çš„ãªå›žç”ã¨ã—ã¦ã¯ã€ã€ŒDOMã‚’ä½¿ãˆã°ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ãªã‚“ã¦æ°—ã«ã—ãªãã¦ã„ã„ã‚ˆã€ãŒæŒ™ã’ã‚‰ã‚Œã‚‹ã§ã—ã‚‡ã†ã€‚ã†ã ã†ã è¨€ã‚ãšé»™ã£ã¦DOMã‚’ä½¿ã†ã¹ã—ã€‚ â€¦ã¾ã‚ã§ã‚‚ã€å¿…è¦ãªã‚±ãƒ¼ã‚¹ã‚‚ã‚ã‚‹ã§ã—ã‚‡ã†ã€‚ç‰¹ã«innerHTMLã®é«˜é€Ÿæ€§ã¯é…åŠ›çš„ã§ã™ã€‚T.jsã‚’ä½œã£ãŸã¨ãã«ãƒ™ãƒ³ãƒãƒžãƒ¼ã‚¯ã‚’å–ã£ãŸã®ã§ã™ãŒã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—é–¢æ•°ã‚’ã¯ã•ã‚“ã§ã‚‚innerHTMLã®æ–¹ãŒé«˜é€Ÿã«å‹•ä½œã™ã‚‹ã“ã¨ãŒç¢ºã‹ã«ã‚ã‚Šã¾ã—ãŸã€‚ ãã‚“ãªã‚ã‘ã§ã€ä¸–ã®ä¸ã«ã¯HTMLã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹è‡ªå‰å®Ÿè£…ã®é–¢æ•°ãŒã‚ãµã‚Œã¦ã„ã¾ã™ã€‚ã•ã‚“ã–ã‚“èªžã‚Šå°½ãã•ã‚Œã¦ã„ã‚‹æ°—ã‚‚ã—ã¾ã™ãŒã€prototype.jsã®å®Ÿè£…ã‚’è¦‹ã¦ã„ã¦å°‘ã—æ°—ã«ãªã£ãŸã®ã§å–ã‚Šä¸Šã’ã¦ã¿ã¾ã™ã€‚ escapeHTMLã®å ´åˆ escapeHTML æ–‡å—åˆ—ä¸ã®ç‰¹å®šã®æ–‡
terkel 2011/08/15
javascript

escape
ãƒªãƒ³ã‚¯
DHTML - æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã¯æ§‹é€ åŒ–ã™ã‚‹ã®ãŒã‚„ã£ã±æ£ã—ã„ : 404 Blog Not Found
2010å¹´09æœˆ23æ—¥02:00 ã‚«ãƒ†ã‚´ãƒªLightweight Languages DHTML - æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã¯æ§‹é€ åŒ–ã™ã‚‹ã®ãŒã‚„ã£ã±æ£ã—ã„ ã†ãƒ¼ã‚“ã€æ°—ã«é£Ÿã‚ãªã„ã€‚ 404 Blog Not Found:æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®é–“é•ã£ãŸã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦ make_link = function(href, text) { var a = document.createElement('a'); a.href = href; a.innerHTML = text; var div = document.createElement('div'); div.appendChild(a); return div.innerHTML; }; ä½•ãŒæ°—ã«é£Ÿã‚ãªã„ã£ã¦ã€æŠ˜è§’ä½œã£ãŸDOMã¨ã„ã†æ§‹é€ ã‚’ãƒ™ã‚¿ãƒ†ã‚ã‚¹ãƒˆã«æˆ»ã—ã¡ã‚ƒã†ã¨ã“ã‚ã€‚ è„±æ§‹é€ ã—ãªã„ä¾‹ ã“ã†ã™ã‚Œã°ã‚ˆã„ã®ã§ã¯ãªã„ã‹ã€‚ (function(){ v
terkel 2011/04/27
twitter

security

escape
ãƒªãƒ³ã‚¯
Kazuho@Cybozu Labs: (Twitter ã® XSS è„†å¼±æ€§ã«é–¢é€£ã—ã¦) æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®æ£ã—ã„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦
æ˜¨æ—¥ã® Twitter ã® XSS é¨’ãŽã¯ã€ã¾ã çš†ã•ã‚“ã®è¨˜æ†¶ã«æ–°ã—ã„ã“ã¨ã¨æ€ã„ã¾ã™ã€‚ã„ã„æ©Ÿä¼šãªã®ã§ã€ãƒ„ã‚¤ãƒ¼ãƒˆã®ã‚ˆã†ãªæ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦è§¦ã‚Œã¦ãŠããŸã„ã¨æ€ã„ã¾ã™ã€‚ Twitter ã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã¯ã€å˜ãªã‚‹å¹³æ–‡ï¼ˆãƒ—ãƒ¬ã‚¤ãƒ³ãƒ†ã‚ã‚¹ãƒˆï¼‰ã§ã¯ãªãã€ã€Œ@è‹±æ•°å—ã€ã®ã‚ˆã†ãªä»–ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¸ã®è¨€åŠã¨ã€Œhttp://ã€œã€ã®ã‚ˆã†ãª URL ã‚’è‡ªå‹•çš„ã«ãƒã‚¤ãƒ‘ãƒ¼ãƒªãƒ³ã‚¯åŒ–ã™ã‚‹æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã§ã™ã€‚ ã“ã®ã‚ˆã†ãªè¤‡æ•°ã®ãƒ«ãƒ¼ãƒ«ã‚’ã‚‚ã¤æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã‚’ HTML åŒ–ã™ã‚‹éš›ã«ã¯ã€ã©ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã‚’æ›¸ã‘ã°ã„ã„ã®ã§ã—ã‚‡ã†ï¼Ÿã€€ã¾ãšã€Œ@ã€œã€ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ã¦ã‹ã‚‰ã€URL ã‚’ãƒªãƒ³ã‚¯åŒ–ã™ã‚Œã°ã„ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿã€€ãã‚Œã ã¨ã€@ã€œ ã®ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ãŸ A HREF ã‚¿ã‚°ã®ä¸ã® URL ãŒã•ã‚‰ã«ãƒªãƒ³ã‚¯åŒ–ã•ã‚Œã¦ã„ã¾ã„ã¾ã™ãã€‚ ã§ã¯ã€URL ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ã¦ã‹ã‚‰ @ã€œ ã‚’ãƒªãƒ³ã‚¯åŒ–ã™ã‚Œã°ã„ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿã€€ãã‚Œã ã¨ã€@ ã‚’å«ã‚€ URL ãŒã‚ã£ãŸå ´åˆã«
terkel 2011/04/27
security

twitter

escape
ãƒªãƒ³ã‚¯
Kazuho@Cybozu Labs: String::Filter ã£ã¦ã„ã†ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«æ›¸ã„ãŸ - ç¶š: (Twitter ã® XSS è„†å¼±æ€§ã«é–¢é€£ã—ã¦) æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®æ£ã—ã„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦
å…ˆã®ã‚¨ãƒ³ãƒˆãƒªã€Œ(Twitter ã® XSS è„†å¼±æ€§ã«é–¢é€£ã—ã¦) æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®æ£ã—ã„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦ã€ã®ç¶šãã€‚ å¼¾ã•ã‚“ãŒã€Œ404 Blog Not Found:DHTML - æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã¯æ§‹é€ åŒ–ã™ã‚‹ã®ãŒã‚„ã£ã±æ£ã—ã„ã€ã§ç¤ºã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ãª DOM ãƒ™ãƒ¼ã‚¹ã®æ“ä½œã‚’è¡Œãˆã°ã€åŽŸç†çš„ã« XSS è„†å¼±æ€§ã‚’é˜²ãã“ã¨ãŒã§ãã¾ã™ã€‚ãŸã ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ JavaScript ã«ã‚ˆã‚‹ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã¯ã‚¦ã‚§ãƒ–ã®æ§‹é€ ã‚’ç ´å£Šã™ã‚‹ã¨ã„ã†ç‚¹ã§ç‹ãŒæ‚ªã„ï¼ˆãƒ†ãƒ¼ãƒ–ãƒ«ã¨ FONT ã‚¿ã‚°ã‚’åˆ©ç”¨ã—ãŸãƒšãƒ¼ã‚¸ãƒ¬ã‚¤ã‚¢ã‚¦ãƒˆãŒæ‰¹åˆ¤ã•ã‚Œã¦ã„ãŸé ƒã‚’è¦šãˆã¦ã„ã‚‰ã£ã—ã‚ƒã„ã¾ã™ã§ã—ã‚‡ã†ã‹ã€‚JavaScript ã«ã‚ˆã‚‹ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã¯ã‚¦ã‚§ãƒ–ã®ãƒªãƒ³ã‚¯æ§‹é€ ã‚‚ç ´å£Šã™ã‚‹ã®ã§ä¸€å±¤ãŸã¡ãŒæ‚ªã„ã¨ã„ã†ã®ãŒè‡ªåˆ†ã®è€ƒãˆï¼‰ã§ã™ã—ã€ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã§ã® DOM æ“ä½œã¯é‡ãŸã„ã®ã§ã€ã§ãã‚Œã°é¿ã‘ãŸã„ã¨ã“ã‚ã§ã™ã€‚ æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã® HTML ã¸ã®å¤‰æ›ã¯ã€ã‚ˆã»ã©è¤‡é›‘ãªè¨˜æ³•ã§ãªã„é™ã‚Š
terkel 2011/04/27
security

twitter

escape
ãƒªãƒ³ã‚¯
There's more to HTML escaping than &, <, >, and " - wonko.com
A few days ago I tweeted: If I had a dollar for every HTML escaper that only escapes &, <, >, and ", I'd have $0. Because my account would've been pwned via XSS." This was exaggeration for effectâ€”there arenâ€™t many cases where a simple XSS injection could actually empty a bank accountâ€”but I wanted to make a point. By some coincidence, Iâ€™ve found myself working with various open source projects rece
terkel 2011/04/24
xss

security

escape
ãƒªãƒ³ã‚¯
jQueryã§æ–‡å—å‚ç…§ã«å¤‰æ›
jQueryã«æ–‡å—åˆ—ã«å«ã¾ã‚Œã‚‹ç‰¹å®šã®æ–‡å—ã‚’æ–‡å—å‚ç…§ã¸å¤‰æ›ã™ã‚‹ãã®ã‚‚ã®ãšã°ã‚Šãªãƒ¡ã‚½ãƒƒãƒ‰ã¯ç„¡ã„(ã‚ˆãï¼Ÿ)ãŒã€ãƒ€ãƒŸãƒ¼ã®è¦ç´ ã‚’ä½œæˆã—ã€text()ã§å¤‰æ›ã—ãŸã„æ–‡å—åˆ—ã‚’ã‚»ãƒƒãƒˆã—ã¦ã‹ã‚‰html()ã§å†…å®¹ã ã‘å–ã‚Šå‡ºã—ã¦ã‚„ã‚‹ã¨ã†ã¾ã„ã“ã¨å¤‰æ›ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚ var s = $("<u/>").text(s).html(); ã“ã‚Œã ã‘ã§sãŒæ–‡å—å‚ç…§ã«å¤‰æ›ã•ã‚Œã‚‹ã€‚ã©ã†å¤‰æ›ã•ã‚Œã‚‹ã‹ã¯å„ãƒ–ãƒ©ã‚¦ã‚¶ã®innerHTMLã®ä»•æ§˜ã«ä¾å˜ã™ã‚‹ã®ã ã¨æ€ã†ã€‚ æ€ã„ã¤ã„ãŸæ™‚ã¯replace()ä¸¦ã¹ã‚‹ã‚ˆã‚Šã¯ãƒžã‚·ã‹ãªã¨æ€ã£ãŸã‘ã©ã€ç›´è¦³çš„ãªã‚³ãƒ¼ãƒ‰ã§ã¯ãªã„ã®ã§ä¸€é•·ä¸€çŸã€‚å„ãƒ–ãƒ©ã‚¦ã‚¶ãŒãã£ã¨è‰¯ãã«è¨ˆã‚‰ã£ã¦ãã‚Œã‚‹ã§ã‚ã‚ã†ç‚¹ã¯ãªã‹ãªã‹è‰¯ã„æ°—ã‚‚ã™ã‚‹ã€‚ çŸã„ã‚¨ãƒ³ãƒˆãƒªã ã€‚
terkel 2009/06/11
jquery

characterreference

escape
ãƒªãƒ³ã‚¯
1