Slide 27
Slide 27 text
DOM Based XSS
const hash = decodeURIComponent(location.hash.slice(1));
document.querySelector('#result').innerHTML = hash;
ϩέʔγϣϯϋογϡͷΛ
JavaScriptͰૠೖ
Slide 28
Slide 28 text
DOM Based XSS
const hash = decodeURIComponent(location.hash.slice(1));
document.querySelector('#result').innerHTML = hash;
ϩέʔγϣϯϋογϡͷΛ
JavaScriptͰૠೖ
Slide 34
Slide 34 text
ةݥͳจࣈྻͷআॲཧ
আॲཧ
Slide 49
Slide 49 text
DOMPurify
const untrustedStr = location.hash;
//
const trustedStr = DOMPurify.sanitize(untrustedHTML);
$('#foo').innerHTML = trustedStr;
//
Slide 50
Slide 50 text
DOMPurify
const untrustedStr = location.hash;
//
const trustedStr = DOMPurify.sanitize(untrustedHTML);
$('#foo').innerHTML = trustedStr;
//
MPDBUJPOIBTIͷ͕
ͦͷ··4JOL͞ΕͨΒ
εΫϦϓτ͕࣮ߦ͞ΕΔ
Slide 51
Slide 51 text
DOMPurify
const untrustedStr = location.hash;
//
const trustedStr = DOMPurify.sanitize(untrustedHTML);
$('#foo').innerHTML = trustedStr;
//
%0.1VSJGZTBOJUJ[FʹΑΓ
ةݥͳจࣈྻ͚ͩআڈ͞ΕΔ
Slide 64
Slide 64 text
content-security-policy: script-src ‘self’
alert("XSS")
ϗετͱϙʔτ͕ಉ͡εΫϦϓτͷΈڐՄ
Slide 65
Slide 65 text
content-security-policy: script-src ‘self’
alert("XSS")
ϗετͱϙʔτ͕ಉ͡εΫϦϓτͷΈڐՄ
ࢦఆ͞Εͨϗετͱҧ͏ͷͰېࢭ
❌
Slide 66
Slide 66 text
content-security-policy: script-src ‘self’
alert("XSS")
ϗετͱϙʔτ͕ಉ͡εΫϦϓτͷΈڐՄ
❌
❌
ΠϯϥΠϯεΫϦϓτېࢭ
Slide 67
Slide 67 text
content-security-policy: script-src ‘self’
alert("XSS")
ϗετͱϙʔτ͕ಉ͡εΫϦϓτͷΈڐՄ
❌
❌
❌
ΠϕϯτଐੑKBWBTDSJQUͳͲېࢭ
Slide 84
Slide 84 text
const myPolicy = trustedTypes.createPolicy("my-policy", {
createHTML: (s) => {
return DOMPurify.sanitize(s);
}
});
Trusted Types & DOMPurify
const hash = decodeURIComponent(location.hash.slice(1));
const trustedHtml = myPolicy.createHTML(hash)
document.body.innerHTML = trustedHtml;