February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
326
3
부
방어
사용하는
XML
파서에
XXE
가 기본으로 비활성화되어 있을 것으로 넘겨짚지 말고
API
문서를
꼭 확인해야 한다.
24.1
다른 데이터 포맷 평가
애플리케이션을 어떻게 사용하는가에 따라
XML
외의 데이터 포맷을 사용하게 애플리케이션
의 아키텍처를 변경하는 것이 가능할 수도 있다. 이러한 변경 방식은
XXE
의 위험을 제거하면
서 코드베이스를 단순화할 수 있다. 일반적으로
XML
은
JSON
과 상호교환적이므로 기본값을
JSON
을 바꿀 수 있다.
한편 애플리케이션이
XML
,
SVG
같은
XML
에서 파생된 파일 유형을 파싱한다면
JSON
은 실
용적이지 않을 것이다. 하지만 애플리케이션이 표준적인 계층적 페이로드를 전송하는 데
XML
의 형태를 이용했을 뿐이라면 실용적인 솔루션이 될 것이다.
JSON
과
XML
을 비교해 [표
24
-
1
]에 나열했다.
표
24-1 XML
과
JSON
비교
비교 항목
XML JSON
페이로드 크기 큼 작음
명세의 복잡성 높음 낮음
사용 편의성 복잡한 파싱 필요 자바스크립트와 호환되는 단순한 파싱
메타데이터 지원 지원 미지원
렌더링(
HTML
비슷한 구조를 통함)
쉬움 어려움
혼합된 콘텐츠 지원 미지원
스키마 검증 지원 미지원
객체 매핑 없음 자바스크립트
가독성 낮음 높음
주석 지원 미지원
보안 낮음 높음
두 포맷을 비교하는 데 오랜 시간을 쏟을 수도 있겠지만 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.