{"author_url":"https://blog.hatena.ne.jp/tomotomo1129/","url":"https://job-info.hateblo.jp/entry/2024/08/05/192841","description":"Thymeleaf\u3067XSS\u5bfe\u7b56\u3092\u3059\u308b\u65b9\u6cd5 1. \u81ea\u52d5\u30a8\u30b9\u30b1\u30fc\u30d7 2. th:utext \u3068 th:text \u306e\u4f7f\u3044\u5206\u3051 3. \u5c5e\u6027\u5024\u306b\u30a8\u30b9\u30b1\u30fc\u30d7\u3092\u4f7f\u7528 4. th:if \u3084 th:unless \u3067\u6761\u4ef6\u3092\u6307\u5b9a\u3059\u308b 5. \u30ab\u30b9\u30bf\u30e0\u30a8\u30b9\u30b1\u30fc\u30d7\u95a2\u6570\u306e\u4f5c\u6210 Thymeleaf\u3067XSS\u5bfe\u7b56\u3092\u3059\u308b\u65b9\u6cd5 Thymeleaf\u3067XSS\uff08\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\uff09\u5bfe\u7b56\u3092\u3059\u308b\u306b\u306f\u3001\u4ee5\u4e0b\u306e\u65b9\u6cd5\u304c\u8003\u3048\u3089\u308c\u307e\u3059\u3002 1. \u81ea\u52d5\u30a8\u30b9\u30b1\u30fc\u30d7 Thymeleaf\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u3067HTML\u30a8\u30b9\u30b1\u30fc\u30d7\u3092\u884c\u3044\u307e\u3059\u3002 \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u5185\u306e\u5909\u6570\u306f\u81ea\u52d5\u7684\u306b\u30a8\u30b9\u30b1\u30fc\u30d7\u3055\u308c\u3001XSS\u653b\u6483\u304b\u3089\u4fdd\u8b77\u3055\u308c\u307e\u3059\u3002 <p th:text=\"${userInput\u2026","categories":["Java","Thymeleaf"],"version":"1.0","provider_name":"Hatena Blog","author_name":"tomotomo1129","blog_url":"https://job-info.hateblo.jp/","published":"2024-08-05 19:28:41","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fjob-info.hateblo.jp%2Fentry%2F2024%2F08%2F05%2F192841\" title=\"Thymeleaf\u3067XSS\u5bfe\u7b56\u3092\u3059\u308b\u65b9\u6cd5 - Web\u958b\u767a\u306b\u304a\u3051\u308b\u77e5\u898b\u5171\u6709\u7cfb\u30da\u30fc\u30b8\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","type":"rich","title":"Thymeleaf\u3067XSS\u5bfe\u7b56\u3092\u3059\u308b\u65b9\u6cd5","blog_title":"Web\u958b\u767a\u306b\u304a\u3051\u308b\u77e5\u898b\u5171\u6709\u7cfb\u30da\u30fc\u30b8","provider_url":"https://hatena.blog","image_url":null,"height":"190","width":"100%"}