Atom ã‚„ RDF を利用ã—ãŸXSS - 葉ã£ã±æ—¥è¨˜Internet Explorer ã®æ‚ªå高ㄠContent-Type: 無視ã¨ã„ã†ä»•æ§˜ã‚’利用ã™ã‚‹ã¨ã€Atom ã‚„ RDF/RSS を利用ã—ã¦XSSを発生ã§ãã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚æ¡ä»¶çš„ã«å¯¾è±¡ã¨ãªã‚‹Webアプリケーションã¯å¤šãã¯ãªã„ã¨æ€ã„ã¾ã™ãŒã€ãã‚Œã§ã‚‚ã„ãã¤ã‹è©²å½“ã™ã‚‹WebアプリケーションãŒå®Ÿåœ¨ã™ã‚‹ã“ã¨ã‚’確èªã—ã¾ã—ãŸã€‚以下ã®ä¾‹ã§ã¯ Atom ã®å ´åˆã«ã¤ã„ã¦æ›¸ã„ã¦ã„ã¾ã™ãŒ RDF/RSS ã§ã‚‚åŒæ§˜ã§ã™ã€‚ 例ãˆã°ã€http://example.com/search.cgi?output=atom&q=abcd ã¨ã„ㆠURL ã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ã€ã€Œabcdã€ã¨ã„ã†æ–‡å—列ã®æ¤œç´¢çµæžœã‚’ Atom ã¨ã—ã¦è¿”ã™CGIãŒã‚ã£ãŸã¨ã—ã¾ã™ã€‚ GET /search.cgi?output=atom&q=abcd Host: example.com HTTP/1.1 200 OK Content-Type: ap
Jibbering Musings » Don't serve JSON as text/html
http://www.tbray.org/ongoing/When/200x/2006/02/21/Why-We-Need-Atom
{{#tags}}- {{label}}
{{/tags}}