{"url":"https://news-nknskn.hatenablog.com/entry/2020/10/01/161325","blog_url":"https://news-nknskn.hatenablog.com/","provider_url":"https://hatena.blog","categories":[],"author_url":"https://blog.hatena.ne.jp/news-nknskn/","image_url":null,"provider_name":"Hatena Blog","published":"2020-10-01 16:13:25","width":"100%","version":"1.0","blog_title":"nknskn \u30cd\u30bf\u7f6e\u304d\u5834","title":"\u30d5\u30a1\u30a4\u30eb\u3092\u81ea\u52d5\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3092\u3059\u308bxhr - XSS\u7cfb\u5c0f\u30cd\u30bf","html":"","description":"XSS\u7cfb\u306e\u5c0f\u30cd\u30bf\u3001multipart + \u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306e\u7b87\u6240\u306bReflected XSS\u304c\u3042\u308b\u3088\u3046\u306a\u5834\u5408\u306e\u305f\u3081\u306ehtml \u88dc\u8db3 \u30d5\u30a1\u30a4\u30eb\u30b3\u30f3\u30c6\u30f3\u30c4\u306b\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3068\u767a\u706b\u3059\u308b\u30b1\u30fc\u30b9 \u30d5\u30a1\u30a4\u30eb\u6a2a\u6d41\u3057\u3067\u306e\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9 \u3061\u306a\u307f\u306b\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u30d5\u30a1\u30a4\u30eb\u306f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u4e0a\u306b\u30ad\u30e3\u30c3\u30b7\u30e5\u3055\u308c\u308b\u3002\u3082\u3057\u304b\u3057\u305f\u3089\u305d\u3053\u304b\u3089\u4f55\u304b\u3057\u3089\u3067\u304d\u308b\u304b\u3082\u3067\u304d\u306a\u3044\u304b\u3082\uff08\u308f\u304b\u3089\u306a\u3044\uff09 Auto File Upload