404 Blog Not Found:perl+javascript - 鐃熟てブわ申短鐃緒申URL鐃緒申Mashup鐃塾バワ申鐃春ワ申鐃獣ワ申鐃緒申鐃緒申

鐃緒申鐃術ワ申鐃縦� - dankogai鐃緒申鐃緒申離鐃緒申廛鐃緒申XSS
鐃緒申鐃初ー鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃熟わ申鐃緒申箸鐃緒申鐃� HTML鐃緒申鐃緒申鐃緒申鐃緒申鐃竣わ申鐃緒申鐃緒申討覆鐃緒申辰鐃緒申鐃�

鐃緒申鐃緒申箸鐃緒申箸鐃緒申鐃緒申鐃緒申辰鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申蓮鐃�TB鐃淑わ申鐃緒申Comment鐃淑ど￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申直鐃旬醐申鐃緒申鐃緒申鐃緒申鐃緒申鐃署しわ申鐃淳わ申鐃緒申鐃緒申

鐃緒申鐃盾そ鐃緒申text/html鐃夙わ申鐃銃駕申瓩居申鐃銃わ申鐃緒申里呂鐃緒申鐃緒申鐃緒申鐃緒申隼廚辰鐃�header鐃薯見わ申鐃初、

% HEAD 'http://u.dan.co.jp/r.cgi/<script>alert('easy%20xss');</script>' 
500 Internal Server Error
Connection: close
Date: Fri, 01 Dec 2006 19:15:41 GMT
Server: Apache/1.3.33 (Unix) mod_perl/1.29 DAV/1.0.3
Content-Type: application/octet-stream
Client-Date: Fri, 01 Dec 2006 19:15:41 GMT
Client-Peer: 219.127.162.235:80
Client-Response-Num: 1

orz鐃緒申鐃淑駕申鐃緒申鐃叔常申鐃渋のわ申鐃緒申鐃緒申鐃�fix鐃緒申

+++ r.cgi       2006/12/02 07:01:53
@@ -1,6 +1,6 @@
 #!/usr/local/bin/perl -T
 #
-# $Id: r.cgi,v 0.1 2006/11/16 20:35:10 dankogai Exp $
+# $Id: r.cgi,v 0.3 2006/12/02 07:01:52 dankogai Exp dankogai $
 #
 use strict;
 use warnings;
@@ -12,7 +12,8 @@
 my $dbfile = '.eid2uri.db';
 
 local $SIG{__DIE__} = sub {
-    print "Status: 500\n\n", @_;
+    print join("\n", "Status: 500", "Content-Type: text/plain", 
+              "\n", @_, " " x 512), "\n";
     exit;
 };

Go ahead. Make my day.

鐃緒申鐃塾種申法鐃緒申他鐃祝も広鐃緒申鐃緒申鐃緒申鐃緒申鐃夙思わ申鐃緒申Status 500鐃緒申鐃緒申箸鐃緒申鐃緒申覆鼻鐃�Message鐃緒申必鐃緒申鐃緒申鐃緒申HTML鐃叔なわ申鐃銃もい鐃緒申鐃緒申隋�Content-Type: text/plain鐃祝わ申鐃銃わ申鐃殉わ申鐃夙わ申鐃緒申鐃塾はわ申鐃緒申鐃緒申鐃緒申鐃塾わ申覆鐃緒申鐃緒申鐃緒申鐃殉で「実行」わ申鐃緒申討鐃緒申泙鐃緒申里鐃緒申箸鐃緒申鐃緒申蕁�鐃緒申鐃緒申呂發�鐃瞬ラウ鐃緒申(User Agent)鐃緒申鐃緒申鐃緒申鐃緒申

Dan the Man to Err