[B! JavaScript][security] terurouã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

terurou id:terurou

JavaScriptã¨securityã«é–¢ã™ã‚‹terurouã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (17)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Node.jsã«ãŠã‘ã‚‹ãƒ—ãƒãƒˆã‚¿ã‚¤ãƒ—æ±šæŸ“æ”»æ’ƒã¨ã¯ä½•ã‹ - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã« æœ€è¿‘ã‚ã‘ã‚ã£ã¦Nodeã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£èª¿æŸ»ã‚’ã—ã¦ã„ã‚‹ã®ã§ã™ãŒã€ä»Šå¹´ã®5æœˆã«é–‹å‚¬ã•ã‚ŒãŸ North Sec 2018 ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã® Olivier Arteau æ°ã«ã‚ˆã‚‹ ã€ŒPrototype pollution attacks in NodeJS applicationsã€ã¨ã„ã†é¢ç™½ã„ç™ºè¡¨ã‚’è¦‹ã¤ã‘ã¾ã—ãŸã€‚ ã“ã®ç™ºè¡¨ã®è«–æ–‡ã‚„ç™ºè¡¨è³‡æ–™ã€ãƒ‡ãƒ¢å‹•ç”»ãªã©ã‚‚githubã§å…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã—ã€ã¡ã‚‡ã†ã©ã‚¿ã‚¤ãƒŸãƒ³ã‚°ã‚ˆãã‚»ãƒƒã‚·ãƒ§ãƒ³å‹•ç”»ã‚‚æœ€è¿‘å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ github.com Olivier Arteau -- Prototype pollution attacks in NodeJS applications ã“ã®ç™ºè¡¨ã§è§£èª¬ã•ã‚Œã¦ã„ã‚‹ã®ã¯ã€æ‚ªæ„ã®ã‚ã‚‹æ”»æ’ƒè€…ãŒã€JavaScriptè¨€èªžå›ºæœ‰ã®ãƒ—ãƒãƒˆã‚¿ã‚¤ãƒ—ãƒã‚§ãƒ¼ãƒ³ã®æŒ™å‹•ã‚’åˆ©ç”¨ã—ã¦ã€Webã‚µãƒ¼ãƒã‚’æ”»æ’ƒã™ã‚‹æ–¹æ³•ã§ã™ã€‚ ç™ºè¡¨è€…ã¯ã€npmã‹ã‚‰ãƒ€
terurou 2018/10/19
å®‰ç›´ãªObjectã®ãƒžãƒ¼ã‚¸ã€JSã®æ–‡åŒ–ã ã¨å‰²ã¨ã‚„ã‚‰ã‚Œã¡ã‚ƒã£ã¦ã‚‹ã‚“ã‚ˆãã€‚ã‚ã¨ä¾‹ãŒã‚µãƒ¼ãƒãƒ¼ã‚µã‚¤ãƒ‰ã ã‘ã©ã€PWAã‚„ã‚‰ReactNativeã‚„ã‚‰ã§ã‚‚åŒã˜ã“ã¨ã«ãªã‚‹ã‚“ã‚ˆãã€‚

javascript

security
ãƒªãƒ³ã‚¯
iframe sandbox ã¯ä¸‡èƒ½ã§ã¯ãªã„ - è‘‰ã£ã±æ—¥è¨˜
HTML5ã§å°Žå…¥ã•ã‚ŒãŸiframeè¦ç´ ã®sandboxå±žæ€§ã¯ã€ãã®iframeå†…ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«å¯¾ã—JavaScriptã®å®Ÿè¡Œã‚’å§‹ã‚æ§˜ã€…ãªåˆ¶ç´„ã‚’èª²ã™ã“ã¨ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å‘ä¸Šã«å½¹ç«‹ã¤æ©Ÿèƒ½ã§ã‚ã‚‹ã€‚ä¾‹ãˆã°ã€ä»¥ä¸‹ã®ã‚ˆã†ã«æŒ‡å®šã•ã‚ŒãŸiframeã§ã¯ã€iframeå†…ã‹ã‚‰formã®submitãªã©ã¯ã§ãã‚‹ãŒã€iframeå†…ã§ã®JavaScriptã®å®Ÿè¡Œã‚„target=_blankãªã©ã«ã‚ˆã£ã¦ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã‚’é–‹ãã“ã¨ãªã©ã¯ç¦æ¢ã•ã‚Œã‚‹ã€‚ <iframe sandbox="allow-forms" src="..."></iframe> sandboxå±žæ€§ã«æ˜Žç¤ºçš„ã« allow-scripts ã¨ã„ã†å€¤ã‚’æŒ‡å®šã—ãªã„é™ã‚Šã¯iframeå†…ã§ã¯ç›´æŽ¥çš„ã«ã¯JavaScriptã¯å®Ÿè¡Œã§ããªã„ãŒã€ã‹ã¨ã„ã£ã¦iframeå†…ã‹ã‚‰é–“æŽ¥çš„ã«JavaScriptã‚’å¿…ãšã—ã‚‚å®Ÿè¡Œã•ã›ã‚‹ã“ã¨ãŒä¸å¯èƒ½ã‹ã¨ã„ã†ã¨ãã†ã§ã‚‚ãªã„ã€‚ sandboxå±žæ€§
terurou 2016/02/14
javascript

security

sandbox

html5
ãƒªãƒ³ã‚¯
JSè‡ªå‹•ãƒ¬ãƒ“ãƒ¥ãƒ¼ãƒ„ãƒ¼ãƒ«"jswatchdog"ã‚’å…¬é–‹ã—ã¾ã—ãŸ - Cybozu Inside Out | ã‚µã‚¤ãƒœã‚¦ã‚ºã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãƒ–ãƒã‚°
ã“ã‚“ã«ã¡ã¯ã€‚kintone é–‹ç™ºãƒãƒ¼ãƒ ã®å¤©é‡Ž (@ama_ch) ã§ã™ã€‚ã™ã£ã‹ã‚Šæ˜¥ã‚‰ã—ããªã‚Šã¾ã—ãŸãã€‚ å°‘ã—å‰ã« JS ã®è‡ªå‹•ãƒ¬ãƒ“ãƒ¥ãƒ¼ãƒ„ãƒ¼ãƒ« jswatchdog ã‚’ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã§å…¬é–‹ã—ã¾ã—ãŸã®ã§ã€ã“ã¡ã‚‰ã§ç´¹ä»‹ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ ä½¿ã„æ–¹ https://kintone.github.io/jswatchdog/ ä¸Šè¨˜ã® URL ã‚’é–‹ãã€å·¦å´ã®ã‚¨ãƒ‡ã‚£ã‚¿ã« JS ã‚³ãƒ¼ãƒ‰ã‚’è²¼ã‚Šä»˜ã‘ã‚‹ã ã‘ã§ã™ã€‚ å³å´ã«ä¿®æ£ãŒå¿…è¦ãªç®‡æ‰€ãŒè¡¨ç¤ºã•ã‚Œã‚‹ã®ã§ã€é©å®œä¿®æ£ã—ã¾ã™ã€‚ ç‰¹å¾´ ãƒãƒªãƒãƒªã®é–‹ç™ºè€…ã˜ã‚ƒãªãã¦ã‚‚ä½¿ã„ã‚„ã™ã„ä¸€ç”»é¢å®Œçµã® Web ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ lint ãƒ„ãƒ¼ãƒ«ã§ãŠé¦´æŸ“ã¿ã®æ§‹æ–‡ãƒã‚§ãƒƒã‚¯ã®ä»–ã€çŸ¥ã‚‰ãšã«è„†å¼±æ€§ã‚’ä½œã‚Šè¾¼ã‚€ã“ã¨ã‚’é¿ã‘ã‚‹ãŸã‚ã€XSS ã®å¯èƒ½æ€§ãŒã‚ã‚‹ç®‡æ‰€ã«ã‚‚è¦å‘Šã‚’è¡¨ç¤º å†…éƒ¨çš„ã«ã¯ã€JS ã®é™çš„æ§‹æ–‡ãƒã‚§ãƒƒã‚¯ãƒ„ãƒ¼ãƒ«ã¨ã—ã¦ ESLint ã¨ JSHint ã‚’çµ„ã¿è¾¼ã‚“ã§ã„ã¾ã™ã€‚ ã•ã‚‰ã« XSS ã®å¯èƒ½æ€§ãŒã‚
terurou 2015/04/08
javascript

security

lint
ãƒªãƒ³ã‚¯
Content-Security-Policy ã¨ nonce ã®è©± - tokuhirom's blog
Content-Security-Policy ã® nonce ã‚’åˆ©ç”¨ã™ã‚‹ã¨ã€XSS ã®è„…å¨ã‚’ã‹ãªã‚Šè»½æ¸›ã§ãã¾ã™ã€‚ ãã“ã§ã€Web Application Framework ã§ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§å¯¾å¿œã—ãŸã»ã†ãŒã‚ˆã„ã®ã§ã¯ãªã„ã‹ã€ã¨ã„ã†æ—¨ã‚’ @hasegawayosuke ã•ã‚“ã‹ã‚‰æ•™ãˆã¦é ‚ã„ãŸã®ã§ã€å®Ÿè£…ã«ã¤ã„ã¦è€ƒãˆã¦ã¿ã¾ã—ãŸã€‚ ã¨ã‚Šã‚ãˆãš CSP ã® nonce ã¯ã©ã†ã„ã†ã‚‚ã®ãªã®ã‹ã‚’è€ƒæ…®ã™ã‚‹ãŸã‚ã«ã€ã‚³ãƒ¼ãƒ‰ä¾‹ã‚’æŽ¢ã—ã¦ã„ãŸã®ã§ã™ãŒã€å®Ÿéš›ã«å‹•ãã‚µãƒ³ãƒ—ãƒ«ã¨ã„ã†ã‚‚ã®ãŒ nonce é–¢é€£ã®ã‚‚ã®ã§è¦‹å½“ãŸã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ ãã“ã§ã€å®Ÿéš›ã«å‹•ãã‚µãƒ³ãƒ—ãƒ«ã‚’ç”¨æ„ã—ã¾ã—ãŸã€‚ https://github.com/tokuhirom/csp-nonce-sample ä»¥ä¸‹ã¯ Sinatra ã§æ›¸ã‹ã‚ŒãŸã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ã§ã™ã€‚ require 'sinatra' require 'securerandom' get '/' d
terurou 2014/09/26
xss

security

javascript

html
ãƒªãƒ³ã‚¯
Javascript ã§æš—å·åŒ–
2. è‡ªå·±ç´¹ä»‹è‡ªå·±ç´¹ä»‹ æƒ…å¼·ãã°å±‹ã®ä¸ã®äººã“ã¨ç ‚åŽŸ æ˜Œå² ãã°å±‹äº”å…µè¡›ã®åº—ä¸» ç ‚åŽŸ è¬™ä¸€(çˆ¶) ç¾åœ¨â¼†ç´šåœ¨å®…â¼ ã¨ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã®â½‡ã€… â—¦ ãã‚ãã‚æœ¬æ°—å‡ºã—ãŸã„ â—¦ æœ€è¿‘ã¯ C#(WPF) ã„ã˜ã£ã¦ã¾ã™ è¨€èªž â—¦ ãƒ¡ã‚¤ãƒ³ï¼šhtml, css, javascript, PHP, C#â—¦ ãƒ¡ã‚¤ãƒ³ï¼šhtml, css, javascript, PHP, C# â—¦ ã‚µãƒ–ï¼šperl, powershell â—¦ ãŸã—ãªã‚€ç¨‹åº¦ï¼šruby, python â—¦ å¿˜ã‚Œã¤ã¤ã‚ã‚‹ï¼švbs â—¦ ã»ã¼å¿˜ã‚ŒãŸï¼šC æ¾æœ¬çµŒæ¸ˆæ–°èžã®è¨˜äº‹ã¯ä¸€éƒ¨èª¤ã‚ŠãŒã€‚ â—¦ éŽåŽ»ã«ãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã¯ã—ãŸã“ã¨ã‚ã‚Šã¾ã›ã‚“ã€‚ Icons by http://dryicons.com
terurou 2013/06/18
ä¸‹æ‰‹ãªãƒ™ãƒ³ãƒ€ãŒä½œã£ãŸã‚·ã‚¹ãƒ†ãƒ ã‚ˆã‚Šã‹ã¯è‰¯ã•ãã†ã€‚

javascript

SSL

crypto

security
ãƒªãƒ³ã‚¯
SSSSLIDE
terurou 2013/05/23
JITã‹ã‚‰æ”»æ’ƒå¯èƒ½ã‹ãƒ¼

JavaScript

JIT

security
ãƒªãƒ³ã‚¯
æ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€JSONã«ã¯ X-Content-Type-Options: nosniff ã‚’ã¤ã‘ã‚‹ã¹ã - è‘‰ã£ã±æ—¥è¨˜
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã„ã¦JSONã‚’ç”¨ã„ã¦ãƒ–ãƒ©ã‚¦ã‚¶ - ã‚µãƒ¼ãƒé–“ã§ãƒ‡ãƒ¼ã‚¿ã®ã‚„ã‚Šå–ã‚Šã‚’è¡Œã†ã“ã¨ã¯ã‚‚ã¯ã‚„æ™®é€šã®ã“ã¨ã§ã™ãŒã€ã“ã®ã¨ãJSONå†…ã«ç¬¬ä¸‰è€…ã«æ¼ã‚Œã¦ã¯å›°ã‚‹æ©Ÿå¯†æƒ…å ±ãŒå«ã¾ã‚Œã‚‹å ´åˆã¯ã€å¿…ãš X-Content-Type-Options: nosniff ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã‚’ã¤ã‘ã‚‹ã‚ˆã†ã«ã—ã¾ã—ã‚‡ã†(ã‚€ã—ã‚æ©Ÿå¯†æƒ…å ±ã‹ã©ã†ã‹ã«é–¢ã‚ã‚‰ãšã€å…¨ã¦ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«ã¤ã‘ã‚‹ã»ã†ãŒã‚ˆã„ã€‚é–¢é€£:X-Content-Type-Options: nosniff ã¤ã‹ã‚ãªã„ã‚„ã¤ã¯æ»ãã°ã„ã„ã®ã«! - è‘‰ã£ã±æ—¥è¨˜)ã€‚ ä¾‹ãˆã°ã€æ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€ä»¥ä¸‹ã®ã‚ˆã†ãªJSONé…åˆ—ã‚’è¿”ã™ãƒªã‚½ãƒ¼ã‚¹(http://example.jp/target.json)ãŒã‚ã£ãŸã¨ã—ã¾ã™ã€‚ [ "secret", "data", "is", "here" ] æ”»æ’ƒè€…ã¯ç½ ãƒšãƒ¼ã‚¸ã‚’ä½œæˆã—ã€ä»¥ä¸‹ã®ã‚ˆã†ã«JSONé…åˆ—ã‚’vbscriptã¨ã—ã¦èªã¿è¾¼ã¿ã¾ã™ã€‚ã‚‚ã¡ã‚
terurou 2013/05/17
IE

JavaScript

JSON

security
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
terurou 2012/07/09
html

security

password

JavaScript
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
terurou 2011/06/24
jQueryã¯$()ã«ã„ã‚ã„ã‚ã‚„ã‚‰ã›ã™ãŽã¨ã€‚

jQuery

javascript

security

xss

mala
ãƒªãƒ³ã‚¯
ç±³Yahoo!ã§è°è«–ã•ã‚ŒãŸã€ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°ã®å°†æ¥ï¼ˆå¾Œç·¨ï¼‰
ç±³Yahoo!ãŒ11æœˆ8æ—¥ã‹ã‚‰3æ—¥é–“ã«ã‚ãŸã‚Šé–‹å‚¬ã—ãŸWebãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ã®ã‚¤ãƒ™ãƒ³ãƒˆã€ŒYUIConf 2010ã€ã€‚ä¸»ã«Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰æŠ€è¡“ã‚’ä¸å¿ƒã«ã—ãŸã‚»ãƒƒã‚·ãƒ§ãƒ³ãŒä¸¦ã¶ä¸ã§ã€è‘—åäººã«ã‚ˆã‚‹ãƒ‘ãƒãƒ«ãƒ‡ã‚£ã‚¹ã‚«ãƒƒã‚·ãƒ§ãƒ³ã€ŒThe Future of Frontend Engineeringã€ãŒé–‹å‚¬ã•ã‚Œã€ãã®ãƒ“ãƒ‡ã‚ªãŒå…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã®è¨˜äº‹ã¯ã€Œç±³Yahoo!ã§è°è«–ã•ã‚ŒãŸã€ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°ã®å°†æ¥ï¼ˆå‰ç·¨ï¼‰ã€ã®ç¶šãã§ã™ã€‚ å¾Œç·¨ã§ã¯ä¼šå ´ã‹ã‚‰ã®è³ªå•ã‚’ä¸å¿ƒã«ã€IE9å•é¡Œã€HTML5ã¨Webã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ãã—ã¦ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æŽ¡ç”¨ãªã©ã«ã¤ã„ã¦ãƒ‡ã‚£ã‚¹ã‚«ãƒƒã‚·ãƒ§ãƒ³ã—ã¦ã„ã¾ã™ã€‚ å·¦ã‹ã‚‰ã€å¸ä¼šã®Dion Almaerã¨Ben Galbraithã€‚Tantek Ã‡elikã€Joe Hewittã€Elaine Wherryã€Doug Crockfordã€Thomas Shaã€Ryan
terurou 2010/11/29
ã€Œç¾åœ¨ã®ãƒ–ãƒ©ã‚¦ã‚¶ã§æœ€å¤§ã®æ¬ é™¥ã¯ä½•ã ã¨æ€ã„ã¾ã™ã‹ï¼Ÿã€ã€ŽFlashã§ã‚‚ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã§ã‚‚ãªã„ã§ã™ã€‚Javaã§ã™ã€‚å¸‚è²©ã•ã‚Œã¦ã„ã‚‹Exploit Kitsã®å¤šããŒJavaã«å¯¾ã—ã¦æœ‰åŠ¹ãªã‚“ã§ã™ã€‚ã€

web

ria

javascript

html5

security
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
terurou 2010/11/12
security

JSON

javascript

html
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
terurou 2010/10/22
javascript

greasemonkey

security
ãƒªãƒ³ã‚¯
ãã‚ãã‚ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ã«ã¤ã„ã¦ä¸€è¨€ã„ã£ã¦ãŠãã‹ - æœ€é€Ÿè»¢è·ç ”ç©¶ä¼š
Firefox3ã§ã€Œã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ã®Cookieã‚‚ä¿å˜ã™ã‚‹ã€ã‚’ã‚ªãƒ•ã«ã™ã‚‹ã€‚ é˜²ã’ã‚‹ã€‚ ã„ãšã‚Œã®ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚‚ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£è£½ã®cookieã‚’åˆ¶é™ã™ã‚‹ã‚ªãƒ—ã‚·ãƒ§ãƒ³ãŒã‚ã‚‹ãŒã€Firefox3ä»¥å¤–ã ã¨ã€ãƒ•ãƒ¬ãƒ¼ãƒ å†…è¡¨ç¤ºã•ã‚ŒãŸå ´åˆã«ã€Œæ–°è¦ã«cookieã‚’ä¿å˜ã—ãªã„ã€ã ã‘ã§ä¿å˜æ¸ˆã¿ã®cookieã¯é€ä¿¡ã—ã¦ã—ã¾ã†ã€‚ è»½ãèª¿ã¹ã¦ã¿ãŸã¨ã“ã‚ã€æ¬¡ã®ã‚ˆã†ã«ãªã£ãŸã€‚(é–“é•ã£ã¦ãŸã‚‰æ•™ãˆã¦ãã ã•ã„) ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ã®cookieã®æ–°è¦ä¿å˜ ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ã®ä¿å˜æ¸ˆã¿cookieã®é€ä¿¡ è¡¨ç¤ºä¸ã®ãƒ‰ãƒ¡ã‚¤ãƒ³ã®cookieã®ä¿å˜/é€ä¿¡ IE6,7,8(ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆ) x o o IE6,7,8(ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é«˜) x x x Opera9.6(ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆ) o o o Opera9.6(åˆ¶é™) x â–³ o Safari(åˆ¶é™/ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆ) x o o Safari(å…¨ã¦å—ã‘å…¥ã‚Œã‚‹) o o o Firefox2(ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆ) o o
terurou 2009/03/08
ã€Œã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ã¸ã®cookieã®é€ä¿¡ã€ã®ãƒ–ãƒ©ã‚¦ã‚¶æ¯Žã®é•ã„ã®ã¾ã¨ã‚

security

javascript

clickjacking

cookie
ãƒªãƒ³ã‚¯
Greasemonkeyã®å…±é€šãªè½ã¨ã—ç©´ã‚’é¿ã‘ã‚‹ - minghaiã®æ—¥è¨˜
Greasemonkeyã®éŽåŽ»ã«ãŠã„ã¦ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œã®è§£èª¬ã€‚ Greasemonkeyã ã‘ã«é™ã‚‰ãšã€JavaScriptã«ã‚ˆã‚‹ãƒ¦ãƒ¼ã‚¶æ‹¡å¼µã‚’ä½œæˆã—ã¦ã„ã‚‹å…¨ã¦ã®æ–¹ã«å¯¾ã—ã¦ä¸€èªã®ä¾¡å€¤ãŒã‚ã‚‹ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã ã¨æ€ã‚ã‚Œã¾ã™ã€‚ åŽŸæ–‡ï¼šO'Reilly Media - Techno logy and Business Training Greasemonkeyã®å…±é€šãªè½ã¨ã—ç©´ã‚’é¿ã‘ã‚‹ Greasemonkeyã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®æ´å²ãŒã‚ãªãŸã®ä»Šã«ã©ã†å½±éŸ¿ã™ã‚‹ã®ã‹ (è‘—) Mark pilgrim "Greasemonkey Hacks"ã®è‘—è€… 2005/11/11 æ˜”ã€…ã€ã‚ã‚‹ã¨ã“ã‚ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒã‚ã‚Šã¾ã—ãŸã€‚ï¼ˆã“ã‚Œã¯æ™®é€šã®ãŠã¨ãŽè©±ã§ã¯ãªã„ã‹ã‚‰ãã®ã¾ã¾èªã‚“ã§ãã ã•ã„ã€‚ï¼‰ Greasemonkeyã®ã‚¢ãƒ¼ã‚ãƒ†ã‚¯ãƒãƒ£ã¯æœ€åˆã«æ›¸ã‹ã‚Œã¦ä»¥æ¥å¤§å¹…ã«å¤‰æ›´ã•ã‚Œã¦ããŸã€‚Version0.3ã¯åˆã‚ã¦åºƒç¯„å›²ã«äººæ°—ã‚’å¾—ãŸãƒãƒ¼
terurou 2008/01/17
firefox

greasemonkey

javascript

security

è³‡æ–™
ãƒªãƒ³ã‚¯
yohgaki's blog - ã„ã‚ã„ã‚å¤‰ã‚ã£ãŸXSSãŒã‚ã‚Šã¾ã™ãŒ...
(Last Updated On: 2007å¹´10æœˆ12æ—¥)ç§ãŒçŸ¥ã‚‰ãªã‹ã£ãŸã ã‘ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€ã“ã‚Œã«ã¯ã‹ãªã‚Šé©šãã¾ã—ãŸã€‚ã„ã‚ã‚“ãªæ‰€ã§å•é¡ŒãŒæŒ‡æ‘˜ã•ã‚Œã¦ã„ã¾ã™ãŒã€ECMAScriptã«XMLæ©Ÿèƒ½ã‚’è¿½åŠ ã—ãŸã®ã¯ã©ã†ãªã‚“ã§ã—ã‚‡ã†ãâ€¦. ç¢ºã‹ã«ã‹ãªã‚Šä¾¿åˆ©ãªã®ã§ã™ãŒä»¥ä¸‹ã®ã‚³ãƒ¼ãƒ‰ã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã‚‹ã“ã¨ã¯ã»ã¨ã‚“ã©çŸ¥ã‚‰ã‚Œã¦ã„ãªã„ã§ã—ã‚‡ã†ãã€‚ <script> 123[â€+<_>ev</_>+<_>al</_>](â€+<_>aler</_>+<_>t</_>+<_>(1)</_>); </script> å¥½ã‚€ã¨å¥½ã¾ã–ã‚‹é–¢ä¿‚ãªãFirefox 1.5ã‹ã‚‰ä½¿ãˆã‚‹ã®ã§Webé–‹ç™ºè€…ã¯çŸ¥ã£ã¦ãŠã‹ãªã‚Œã°ãªã‚‰ãªã„ã§ã™ã€‚ æ—¥æœ¬èªžè¨³ http://www.ne.jp/asahi/nanto/moon/specs/ecma-357.html åŽŸæ–‡ http://www.ecma-international.org/pu
terurou 2007/10/13
security

E4X

javascript
ãƒªãƒ³ã‚¯
http://youmos.com/news/packer
terurou 2007/08/25
ãƒ‡ãƒãƒƒã‚°ã‚³ãƒ¼ãƒ‰é™¤åŽ»ã¯ã„ã„ãªãã€‚

javascript

åœ§ç¸®

security

webservice
ãƒªãƒ³ã‚¯
ITæˆ¦è¨˜ - IEã‚’è¯éº—ã«æ’ƒå¢œã™ã‚‹ä¸€è¡Œ
ã¯ã„ï¼ ã“ã‚“ã«ã¡ã¯ï¼ï¼ï¼ï¼ï¼ ä»Šæ—¥ã¯ã€å¶ç„¶ãƒ–ãƒ©ã‚¯ãƒ©ç™ºè¦‹ã—ã¡ã‚ƒã£ãŸã‹ã‚‰ã€ãã‚Œã‚’ãŠä¼ãˆã—ã¾ã™ãï¼ ã“ã‚Œã ã‚ˆï¼ <script>document.createStyleSheet().addRule('html > body', 'display:block');</script> â†’ ã‚µãƒ³ãƒ—ãƒ« (IEã ã¨ãƒ–ãƒ©ã‚¦ã‚¶ãŒå›ºã¾ã£ãŸä¸Šã«ãƒ¡ãƒ¢ãƒª 1.5 GB ãã‚‰ã„ãã£ã¡ã‚ƒã†ã‚ˆï¼ æ³¨æ„ã—ã¦ãï¼) IE6ã¨ã‹IE6ã®ã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆãƒ–ãƒ©ã‚¦ã‚¶ã ã¨ç¢ºå®Ÿã«è½ã¡ã¡ã‚ƒã†ã¿ãŸã„ã ãï¼IE7ã¯è½ã¡ãªã„ã‘ã©ï¼ CSSStyleSheet ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã« addRule ã§åå«ã‚»ãƒ¬ã‚¯ã‚¿ã‚’ã‚ã¦ã‚‹ã¨ãƒ€ãƒ¡ãªã‹ã‚“ã˜ã‹ãªï¼ ã¡ãªã¿ã« display:block ã®ç®‡æ‰€ã¯ã©ã‚“ãªãƒ—ãƒãƒ‘ãƒ†ã‚£ã§ã‚‚è½ã¡ã‚‹ã‚ˆï¼ ãªã«ã“ã‚Œï¼ã‚ˆãã‚ã‹ã‚“ãªã„ã‘ã©é¢ç™½ã„ãâ€¦ï¼ Firefoxã¨ã‹Operaå¤§å¥½ãã£åã¯ã€ã“ã‚Œã‚’ãŸãã•ã‚“ãƒãƒ©ã¾ã„ã¦IEã®ã‚·ã‚§ã‚¢ã‚’ã©ã‚“ã©ã‚“ä¸‹ã’ã¡ã‚ƒ
terurou 2007/08/12
ie

javascript

security

bug

ãƒ–ãƒ©ã‚¯ãƒ©

amachang
ãƒªãƒ³ã‚¯
1