hamayanhamayan https://blog.hatena.ne.jp/hamayanhamayan/ はまやんはまやんはまやん https://blog.hamayanhamayan.com/ Security 概要 JSONを渡すAPIに対して、XMLを渡すことができる場合がある その場合にXXEが行えてしまう JSONを渡すAPIに対してXMLが渡せる現象 Playing with Content-Type – XXE on JSON Endpointsのほぼ日本語訳。 例えば、 POST /netspi HTTP/1.1 Host: someserver.netspi.com Accept: application/json Content-Type: application/json Content-Length: 38 {"search":"name","value":"netspitest… 190 <iframe src="https://hatenablog-parts.com/embed?url=https%3A%2F%2Fblog.hamayanhamayan.com%2Fentry%2F2019%2F07%2F20%2F181443" title="XXE on JSON Endpoints - はまやんはまやんはまやん" class="embed-card embed-blogcard" scrolling="no" frameborder="0" style="display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;"></iframe> Hatena Blog https://hatena.blog 2019-07-20 18:14:43 rich https://blog.hamayanhamayan.com/entry/2019/07/20/181443 1.0 100%