February 2013
Intermediate to advanced
380 pages
7h 45m
Japanese
Content preview from Nodeクックブック
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
258
7 章 セキュリティ、暗号化、認証
CompileWithCsrf.protytype.__proto__ = jade.Compiler.prototype;
Object.create
は ECMAScript 5 で追加された手段で、
new
は古い方法です。
__proto__
は JavaScript
標準ではなく V8 の独自仕様なので、おそらく使うべきでありません。いずれも
jade.Compiler
のメソッ
ドとプロパティを
CompileWithCsrf
に継承させますが、
util.inherit
は継承先オブジェクトの
super_
とい
うプロパティに継承元のオブジェクトをそのまま格納するため、優先的に利用するべきです。
ミニレシピ
7.5.2
クロスサイトスクリプティング（
XSS
）脆弱性を取り除く
クロスサイトスクリプティング攻撃は、ユーザ入力のバリデーションとエンコードを行っていれ
ば一般的には防御可能です。しかし、不適切もしくは不十分なエンコードをしてしまった場合に複
雑な問題になりえます。
Web
ページでユーザからの入力を受け付けると、入力後にその内容をブラウザにも出力するこ
とが多くあります。つまり、
HTML
に埋め込む機会が多いということです。
XSS
攻撃はすなわちコンテクストを破壊するということです。例えば、ユーザ名からユーザプ
ロフィールにリンクを張っている
Jade
テンプレートがあると仮定します。
a(href=username) !{username}
このコードは
2
つの意味で悪用可能です ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.