HTML5 Security CheatsheetWhat your browser does when you look away...
ãã®ã³ã³ãã³ãã¯ãã¦ã§ããµã¤ãã®éå¶è ãä¸è¬ã®å©ç¨è ã®æ¹ã¸åãã¦ãã¦ã§ããµã¤ãã«ããã代表ç㪠10 種é¡ã®èå¼±æ§ (ã½ããã¦ã§ã¢çã«ãããã»ãã¥ãªãã£ä¸ã®å¼±ç¹) ã«ã¤ãã¦ãããããããã¢ãã¡ã¼ã·ã§ã³ã§è§£èª¬ãã¦ãã¾ãã ãããã®åé¡ã¯ãæ ¹æ¬çã«ã¯ã¦ã§ããµã¤ãã®éå¶è ã対çãè¡ãã¹ãåé¡ã§ããããããä¸è¬ã®å©ç¨è ã®æ¹ããä¿éºçãªå¯¾çãåããã¨ã§ãã¦ã§ããµã¤ãã®èå¼±æ§ãåå ã¨ãªã£ã¦èµ·ããåé¡ã®è¢«å®³ãæªç¶ã«é²ãã ããæãããã¨ãã§ãã¾ãã詳細ã¯ãå解説ããã³å¯¾çãã¼ã¸ãã覧ãã ããã
æè¿Webã¢ããªã±ã¼ã·ã§ã³ã«åå¨ããã»ãã¥ãªãã£ãã¼ã«ã注ç®ãæµ´ã³ã¦ããããã®ä¸ã§ããã¯ãã¹ãµã¤ãã¹ã¯ãªããã£ã³ã°ãã¨å¼ã°ããèå¼±æ§ãæåã§ããããã¯ãã¹ãµã¤ãã¹ã¯ãªããã£ã³ã°èå¼±æ§ã«ã¤ãã¦æ£ç¢ºã«ç解ãã¦ãã人ãä¾ç¶ã¨ãã¦å°ãªãã¨æããã æ¬ç¨¿ã§ã¯ãã¯ãã¹ãµã¤ãã¹ã¯ãªããã£ã³ã°ã¨ã¯ã©ã®ãããªèå¼±æ§ã§ããã®ãããã®èå¼±æ§ãæã£ããµã¤ããæ»æãããã¨ã©ã®ãããªè¢«å®³ãèµ·ãå¾ãã®ãããªããã®ãããªã»ãã¥ãªãã£ãã¼ã«ãä½ãè¾¼ã¾ãã¦ãã¾ãã®ããã©ã®ããã«å¯¾çãããã°ããã®ãã解説ãã¦ããã â»ä»¥ä¸æ¬æä¸ã§ã¯ãã¯ãã¹ãµã¤ãã¹ã¯ãªããã£ã³ã°èå¼±æ§ã®ãã¨ããXSSãã¨è¡¨è¨ããããCross Site Scriptingãã®ç¥ã§ãããããCSSãã¨è¡¨è¨ãã¦ããè¨äºããããããCascading Style Sheetsãã®ç¥ããCSSãã¨ãªãç´ããããããããXSSãã¨è¡¨è¨ããå ´åãå¤ããªã£ã¦ãã¦ãããæ¬ç¨¿ã§
html5securityã®ãµã¤ãã«ãXSSã®å種æ»æææ³ãã¾ã¨ãããã¦ããã®ãçºè¦ãã!ã¨ãããã¨ã§ãå人çã«ãã!ãã¨æã£ãæ»æããµã³ãã«ã¤ãã§ãç´¹ä»ãã¾ãã 1. CSS Expression IE7以åã«ã¯ãCSS Expressionsãã¨ããæ¡å¼µæ©è½ããããCSSå ã§JavaScriptãå®è¡ã§ããããã¾ãã <div style="color:expression(alert('XSS'));">a</div> ç¢ºèª @IT -ï¼»æè»ãããï¼½IEã®CSS解éã§èµ·ããXSS ã§è©³ãã解説ããã¦ãã¾ãããCSSã®è§£éãæè»ãªãã¨ã¨ãããã¾ã£ã¦èªåã§ç¡å®³åããã®ã¯ãªããªãå°é£ã以ä¸ã®ãããªã³ã¼ãã§ãã¹ã¯ãªãããå®è¡ããã¦ãã¾ãã¾ãã <div style="color:expr/* ã³ã¡ã³ãã®æ¿å ¥ */ession(alert('XSS'));">a</div> ç¢ºèª <div s
ãã®ãã¼ã¸ã«ã¤ãã¦ã®èª¬æã»æ³¨æãªã© PHP ã¯ãApache ã¢ã¸ã¥ã¼ã«ããCGIãã³ãã³ãã©ã¤ã³ã¨ãã¦ä½¿ç¨ã§ããã¹ã¯ãªããè¨èªã§ãããã®ãã¼ã¸ã§ã¯ã主㫠PHP ã«ããããWeb ã¢ããªã±ã¼ã·ã§ã³ã®ã»ãã¥ãªãã£åé¡ã«ã¤ãã¦ã¾ã¨ãã¦ãã¾ãã Web ã¢ããªã±ã¼ã·ã§ã³ã®ã»ãã¥ãªãã£åé¡ã¨ãã¦ã¯ã以ä¸ã®åé¡ã«ã¤ãã¦ããåãæãããã¦ããã¨æãã¾ããããããã®ã»ãã¥ãªãã£åé¡ã«ã¤ãã¦èª¿ã¹ããã¨ããããã以å¤ã§ããPHP ã«é¢é£ãã¦ããã»ãã¥ãªãã£åé¡ã«ã¤ãã¦ç¥ã£ã¦ãããã¨ã«ã¤ãã¦ã¡ã¢ãã¦ããã¾ãã ã¯ãã¹ãµã¤ãã¹ã¯ãªããã£ã³ã° SQL ã¤ã³ã¸ã§ã¯ã·ã§ã³ ãã¹ã»ãã©ãã¼ãµã«(ãã£ã¬ã¯ããªã»ãã©ãã¼ãµã«) ã»ãã·ã§ã³ãã¤ã¸ã£ã㯠ã³ãã³ãã¤ã³ã¸ã§ã¯ã·ã§ã³ ã¾ããPHP ããã¥ã¢ã« : ã»ãã¥ãªãã£ããPHP Security Guide (PHP Security Consortium) ã«ã¯ãPH
ãªãªã¼ã¹ãé害æ å ±ãªã©ã®ãµã¼ãã¹ã®ãç¥ãã
ææ°ã®äººæ°ã¨ã³ããªã¼ã®é ä¿¡
å¦çãå®è¡ä¸ã§ã
j次ã®ããã¯ãã¼ã¯
kåã®ããã¯ãã¼ã¯
lãã¨ã§èªã
eã³ã¡ã³ãä¸è¦§ãéã
oãã¼ã¸ãéã
{{#tags}}- {{label}}
{{/tags}}