{"version":"1.0","url":"https://takapi86.hatenablog.com/entry/2020/12/23/235919","image_url":null,"height":"190","provider_name":"Hatena Blog","blog_url":"https://takapi86.hatenablog.com/","published":"2020-12-23 23:59:19","width":"100%","title":"Smarty\u3067\u306e\u30a8\u30b9\u30b1\u30fc\u30d7\u3092\u307e\u3068\u3081\u305f","categories":[],"description":"Smarty\u3067\u306eXSS\u5bfe\u5fdc\u65b9\u6cd5\u3092\u307e\u3068\u3081\u307e\u3059\u3002 \u8db3\u308a\u3066\u306a\u3044\u30d1\u30bf\u30fc\u30f3\u304c\u3042\u308c\u3070\u8ffd\u52a0\u4e88\u5b9a\u3002 \u53c2\u8003 \u300e\u4f53\u7cfb\u7684\u306b\u5b66\u3076\u5b89\u5168\u306aWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u4f5c\u308a\u65b9 \u7b2c2\u7248\u300f Smarty\u306e\u30b3\u30fc\u30c9 https://github.com/smarty-php/smarty/blob/478f8a29b4da07b7d18164cc8554b967a2036678/libs/plugins/modifier.escape.php \u8981\u7d20\u5185\u5bb9 <p>\u3053\u3053\u306b\u6587\u5b57\u304c\u5165\u308b\u5834\u5408</p> XSS\u5bfe\u7b56\u65b9\u6cd5 < \u3068 & \u3092\u6587\u5b57\u53c2\u7167\u306b\u3059\u308b Smarty\u3067\u306f <{$hoge|escape:'html'}> \u3092\u4f7f\u3044\u307e\u3059\u3002 \u203b & \" ' < >\u2026","provider_url":"https://hatena.blog","blog_title":"takapi\u306e\u30d6\u30ed\u30b0","type":"rich","author_url":"https://blog.hatena.ne.jp/takapi86/","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Ftakapi86.hatenablog.com%2Fentry%2F2020%2F12%2F23%2F235919\" title=\"Smarty\u3067\u306e\u30a8\u30b9\u30b1\u30fc\u30d7\u3092\u307e\u3068\u3081\u305f - takapi\u306e\u30d6\u30ed\u30b0\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","author_name":"takapi86"}