Invoking a function without parentheses
I was told today that it's possible to invoke a function without parentheses. The only ways I could think of was using functions like apply or call. f.apply(this); f.call(this); But these require parentheses on apply and call leaving us at square one. I also considered the idea of passing the function to some sort of event handler such as setTimeout: setTimeout(f, 500); But then the question becom
Into the Borg – SSRF inside Google production network | OpnSec
Intro – Testing Google Sites and Google Caja In March 2018, I reported an XSS in Google Caja, a tool to securely embed arbitrary html/javascript in a webpage. In May 2018, after the XSS was fixed, I realised that Google Sites was using an unpatched version of Google Caja, so I looked if it was vulnerable to the XSS. However, the XSS wasn’t exploitable there. Google Caja parses html/javascript and
脆弱性のあるJavaScriptライブラリを検出するRetire.jsを紹介 - Qiita
「Webには時代遅れで脆弱性のあるJavaScirptライブラリで溢れていることが研究により明らかに」という記事のとおり、世の中には脆弱性のあるJavaScriptライブラリを使った多くのウェブサイトが存在します。 IPAが公開している「安全なウェブサイトの作り方」には脆弱性が修正されたバージョンのライブラリを使用する。と記述があったり、「OWASP TOP10 2017 (日本語版)」にも既知の脆弱性のあるコンポーネントの使用を避けるように、と脆弱性のあるライブラリを使用しないよう注意喚起されています。 脆弱性のあるライブラリを使用しているか調べることができるRetire.jsを紹介します。 すべての脆弱性を防げる保証は無いので、あくまで自己責任でお使いください。 Retire.jsとは Retire.jsは上の画像のようにCLIなどで実行することができる脆弱性のあるJSライブラリを検出
JavaScript Zero: real JavaScript, and zero side-channel attacks | the morning paper
the morning paper a random walk through Computer Science research, by Adrian Colyer Made delightfully fast by strattic JavaScript Zero: Real JavaScript and zero side-channel attacks Schwarz et al., NDSS’18 We’re moving from the server-side back to the client-side today, with a very topical paper looking at defences against micro-architectural and side-channel attacks in browsers. Since submission
Snyk Vulnerability Database | Snyk
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Introducing Storage Access API
Note: Read about improvements to this technology in recent blog posts about Intelligent Tracking Prevention, and the Storage Access API. In June last year we introduced Intelligent Tracking Prevention (ITP). ITP is a privacy feature that detects which domains have the ability to track the user cross-site and either partitions the domain’s cookies or purges its website data all together. The strong
Sign in - Google Accounts
Not your computer? Use a private browsing window to sign in. Learn more about using Guest mode
3rd party Cookie いただきます | TECHSCORE BLOG | TECHSCORE BLOG
こんにちは、中山です（写真は私ではありません）。 以前は Cookie 終焉論的な記事をよく見かけたのですが、最近あまり見かけなくなりましたね。 結局のところ、相も変わらず Cookie は元気に活用され続けているようです。 そこで、今回はトラッキングで話題になりがちな 3rd party Cookie について考察してみましょう。 なお調査に利用したブラウザは以下の通りです。 （iOS と Android の標準ブラウザについてはまたの機会に） Firefox 47.0 Chrome 51.0.2704.103 m Internet Explorer 11.0.32 3rd party Cookie ブロックの動作（ブラウザ目線） ブラウザ目線での 3rd party Cookie とは、ユーザーが閲覧しているページのドメインとは異なるドメインから HTTP Set-Cookie Hea
Array[@@species], Array Index Accessors and Security
このブラウザ バージョンのサポートは終了しました。サポートされているブラウザにアップグレードしてください。
![Array[@@species], Array Index Accessors and Security](https://cdn-ak-scissors.b.st-hatena.com/image/square/43976ef7bba208c1c90fd478052c0322d2eb7170/height=288;version=1;width=512/https%3A%2F%2Flh7-us.googleusercontent.com%2Fdocs%2FAHkbwyLqhWkU06v0jMy87OLJCKydsgl-ItgjqGoGEuX4f6U0UTHSuaErmbjY_rHBrtiJS189hWAqHfL5fQa4BXTtLlcxfvPlApSWEvnWYq-yNp5y2X-daxzl%3Dw1200-h630-p)
Introducing security alerts on GitHub
AI & MLLearn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry. Generative AILearn how to build with generative AI. GitHub CopilotChange how you work with GitHub Copilot. LLMsEverything developers need to know about LLMs. Machine learningMachine learning tips, tricks, and best practices. How AI code generation worksExplore the capabilities and be
GitHub - mikewest/tc39-proposal-literals: Literals could be different than non-literals.
HTML's DOM offers a number of mechanisms to turn arbitrary strings into markup (.innerHTML = ...) or code (scriptEl.innerText = ..., el.onclick = ..., etc). Each of these mechanisms can serve as an XSS sink, giving an attacker the ability to feed code into a context that wasn't expecting it, leading to a class of DOM-based XSS attacks that we'd very much like to avoid. One way of addressing this i
Update on Web Cryptography
Cryptography is the cornerstone of information security, including various aspects such as data confidentiality, data integrity, authentication, and non-repudiation. These provide support for the fundamental technologies of today’s Internet like HTTPS, DNSSEC, and VPN. The WebCrypto API was created to bring these important high-level cryptography capabilities to the web. This API provides a set of
Stealing sensitive browser data with the W3C Ambient Light Sensor API
Security, Privacy & Tech Inquiries Lukasz Olejnik I write about security, privacy, Web, technology and tech policy matters. In this post we describe and demonstrate a neat trick to exfiltrate sensitive information from your browser using a surprising tool: your smartphone or laptop’s ambient light sensor. In short: We provide background about the light sensor API and current discussions to expose
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
GitHub - elbywan/yett: 🔐A small webpage library to control the execution of (third party) scripts
GitHub - agis/mcdetect: Catch mixed content issues in the wild
Reverse Engineering Windows Defender’s JavaScript Engine
It Me: Under the Hood of Web Authentication
List of JavaScript Crypto libraries.
Webには時代遅れで脆弱性のあるJavaScirptライブラリで溢れていることが研究により明らかに
GitHub - mozilla/dispensary: Hashes of popular JavaScript libraries, mainly for the Mozilla's addons-linter