はじめに 対象イベント 読み方、使い方 Remote Code Execution(RCE) 親ディレクトリ指定によるopen_basedirのバイパス PHP-FPMのTCPソケット接続によるopen_basedirとdisable_functionsのバイパス JavaのRuntime.execでシェルを実行 Cross-Site Scripting(XSS) nginx環境でHTTPステータスコードが操作できる場合にCSPヘッダーを無効化 GoogleのClosureLibraryサニタイザーのXSS脆弱性 WebのProxy機能を介したService Workerの登録 括弧を使わないXSS /記号を使用せずに遷移先URLを指定 SOME(Same Origin Method Execution)を利用してdocument.writeを順次実行 SQL Injection MySQ
Last week, I built a tiny Linux system from scratch, and booted it on my laptop! Here’s what it looked like: Let me tell you how I got there. I wanted to learn more about how the Linux kernel works, and what’s involved in booting it. So I set myself the goal to cobble together the bare neccessities required to boot into a working shell. In the end, I had a tiny Linux system with a size of 2.5 MB,
A few months ago, I set myself the challenge of writing a C compiler in 500 lines of Python1, after writing my SDF donut post. How hard could it be? The answer was, pretty hard, even when dropping quite a few features. But it was also pretty interesting, and the result is surprisingly functional and not too hard to understand! There's too much code for me to comprehensively cover in a single blog
GitHub Actions を静的検査するツールの紹介 (actionlint/ghalint/zizmor)
先日、 tj-actions/changed-files や reviewdog/action-* などのアクションの Git タグが書き換えられるという出来事がありました。 これにより、これらのアクションを Git タグで参照している GitHub Actions Workflow 内で悪意のあるコードが実行されてしまうという事態が発生しました。 このような事態を防ぐためには、アクションの参照には Git タグではなくコミットハッシュを使用するなどの対策が必要です。 # ❌ Git タグは書き換えられる可能性がある - uses: actions/checkout@v4 - uses: actions/checkout@v4.2.2 # ⭕ コミットハッシュを指定しておけば Git タグが書き換えられても影響を受けない - uses: actions/checkout@11bd71901
Modern Emacs Typescript Web (React) Config with lsp-mode, treesitter, tailwind, TSX & more - Ovi Stoica
Table of Contents Introduction Part 1: Treesitter for Typescript & TSX LSP Support Completion setup Linter setup LSP Setup Eslint (Optional) Tailwind LSP Server LSP Performance Emacs LSP Booster Structural editing Formatting buffers with Prettier Other resources Conclusion Introduction I've worked within the JS ecosystem for the past 8 years using editors like Webstorm and VSCode, I started using
鈴木たかのりです。今月のPython Monthly Topicsでは、Python 3.10から導入されたBetter error messagesについて紹介します。Better error messagesがどういったものであるかの紹介と、どのようにこのエラーメッセージが出力されているか、Python内部の処理についても触れようと思います。 Better error messagesとは Python 3.10からBetter error messagesという機能が追加されました。この機能は名前のとおり「エラーメッセージを改善」するものです。「エラーメッセージの改善」により以前よりもわかりやすいエラーメッセージが出力され、ユーザーがエラーの意味に気づきやすくなりました。 例として、以下のようなリストの閉じカッコ（]）を忘れたコードを実行し、出力されるエラーメッセージを見比べてみま
I thought it would be fun to go outside of my comfort zone of web development topics and write about something completely different and new, something I have never written about before. So today, I'm going to show you how to implement a programming language! The project will parse and execute programs written in a simple language I called my (I know it's a lame name, but hey, it is "my" language).
Python's "Type Hints" are a bit of a disappointment to me
blog - git - desktop - images - contact Python's "Type Hints" are a bit of a disappointment to me 2022-04-21 Preface You are reading version 2.0 of this blog post. I've incorporated some feedback I got into this revised version. Introduction Over the course of several Python 3.x versions, "type hints" were introduced. You can now annotate functions: def greeting(name: str) -> str: return 'Hello '
python_modules.pdf
Python3 OpenCV / Pillow / pygame / Eel / PyDub / NumPy / matplotlib / SciPy / SymPy / gmpy2 / hashlib, passlib / Cython / Numba / ctypes / PyInstaller / curses / tqdm / JupyterLab / json / psutil / urllib / zenhan / jaconv Copyright © 2017-2025, Katsunori Nakamura 2025 8 19 Python ‘ .py’ Python Python Windows PSF Python py .py Enter macOS Linux PSF Python python3 .py Enter Anaconda Prompt Python p
鈴木たかのりです。今月からgihyo.jp上で「Python Monthly Topics」と題して、毎月Python関連の話題になったトピックやツール、ライブラリなどを紹介していきたいと思います。 第1回目はPython 3.10の新機能「構造化パターンマッチング（Structural Pattern Matching）」について紹介します。 Python 3.10の新機能 Python 3.10は2021年10月4日にリリースされました。現在のPythonの最新バージョンは3.10.5で、Download Pythonのページからダウンロードできます。 Python 3.10.5のリリースページを見ると、謎のヘビの画像があります。 Python 3.10 release logo この画像はPython 3.10 release logoという画像で、ヘビの周りにPython 3.
What's new in Python 3.11?
What's new in Python 3.11?Built-in TOML support, better exceptions, and typing improvements. By Tushar·InsightsPython The first beta release of Python 3.11 is out, bringing some fascinating features for us to tinker with. This is what you can expect to see in 2022's release of Python later this year. Even better error messagesPython 3.10 gave us better error messages in various regards, but Python
Tier 4 Support § Support for these targets is entirely experimental. If this target is provided by LLVM, LLVM may have the target as an experimental target, which means that you need to use Zig-provided binaries for the target to be available, or build LLVM from source with special configure flags. zig targets will display the target if it is available. This target may be considered deprecated by
Lean for JavaScript DevelopersSeptember 2, 2025 This is my opinionated syntax primer for the Lean programming language. It is far from complete and may contain inaccuracies (I’m still learning Lean myself) but this is how I wish I was introduced to it, and what I wish was clarified. Why Lean? This post assumes you’re already eager to learn a bit of Lean. For motivation, I humbly submit to you two
I want to write a post about Pitchfork, explaining where it comes from, why it is like it is, and how I see its future. But before I can get to that, I think I need to share my mental model on a few things, in this case, Ruby’s GVL. For quite a long time, it has been said that Rails applications are mostly IO-bound, hence Ruby’s GVL isn’t that big of a deal and that has influenced the design of so
Version 1.106 is now available! Read about the new features and fixes from October. Update 1.86.2: The update addresses these issues. Update 1.86.1: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the January 2024 release of Visual Studio Code. There are many updates in this version that we hope you'll lik
Node.js — Node v23.6.0 (Current)
2025-01-07, Version 23.6.0 (Current), @marco-ippolito Notable Changes Unflagging --experimental-strip-types This release enables the flag --experimental-strip-types by default. Node.js will be able to execute TypeScript files without additional configuration: There are some limitations in the supported syntax documented at https://nodejs.org/api/typescript.html#type-stripping This feature is exper
Tier 4 Support § Support for these targets is entirely experimental. If this target is provided by LLVM, LLVM may have the target as an experimental target, which means that you need to use Zig-provided binaries for the target to be available, or build LLVM from source with special configure flags. zig targets will display the target if it is available. This target may be considered deprecated by
BigQueryを補完する技術: DuckDBとDataflowでのデータ処理入門 - yasuhisa's blog
背景 & Disclaimer DuckDB 概念や代表的なユースケース 使ってみる 1週間〜一ヶ月などある程度の期間、分析で使いたい場合 便利なCLIツールとして使う 所感 参考 Dataflow 代表的なユースケース 具体例 参考 背景 & Disclaimer BigQueryは非常に便利で、BigQueryにさえ上がってしまえばSQLで巨大なデータを簡単に相手にできます とはいえ、BigQueryに行きつくまでが大変な場合もありえます 例: 個人情報を含むsensitiveなデータで、BigQueryに気軽に上げられないケース 一時的であっても、相談なしにその手のデータを気軽にアップロードするのはやめてください... 数万件程度であれば手元のエクセルで開いて、問題ない行/列だけに絞る、ということもできるが、もっと量が多いデータだとそういうわけにもいかない。そもそも分析はSQLでやり
Plan 9 Desktop Guide
PLAN 9 DESKTOP GUIDE INDEX What is Plan 9? Limitations and Workarounds Connecting to Other Systems VNC RDP SSH 9P Other methods Porting Applications Emulating other Operating Systems Virtualizing other Operating Systems Basics Window Management Copy Pasting Essential Programs Manipulating Text in the Terminal Acme - The Do It All Application Multiple Workspaces Tiling Windows Plumbing System Admin
Large Text Compression Benchmark Matt Mahoney Last update: July 3, 2025. history This competition ranks lossless data compression programs by the compressed size (including the size of the decompression program) of the first 109 bytes of the XML text dump of the English version of Wikipedia on Mar. 3, 2006. About the test data. The goal of this benchmark is not to find the best overall compressi
JupyterLab Changelog — JupyterLab 4.5.0a3 documentation
JupyterLab Changelog# v4.4# JupyterLab 4.4 includes a number of new features (described below), bug fixes, and enhancements. This release is compatible with extensions supporting JupyterLab 4.0. Extension authors are encouraged to consult the Extension Migration Guide which lists deprecations and changes to the public API. Code console improvements# The code console prompt can now be positioned on
Python 3.14 runtime now available in AWS Lambda | Amazon Web Services
AWS Compute Blog Python 3.14 runtime now available in AWS Lambda AWS Lambda now supports Python 3.14 as both a managed runtime and container base image. Python is a popular language for building serverless applications. Developers can now take advantage of new features and enhancements when creating serverless applications on Lambda. You can develop Lambda functions in Python 3.14 using the AWS Ma
Release date: July 9, 2025 Update 1.102.1: The update addresses these issues. Update 1.102.2: The update addresses these issues. Update 1.102.3: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the June 2025 release of Visual Studio Code. There are many updates in this version that we hope you'll like, some
Node.js
Notable Changes Deprecations and Removals [f182b9b29f] - (SEMVER-MAJOR) dns: runtime deprecate type coercion of dns.lookup options (Antoine du Hamel) #39793 [4b030d0573] - doc: deprecate (doc-only) http abort related (dr-js) #36670 [36e2ffe6dc] - (SEMVER-MAJOR) module: subpath folder mappings EOL (Guy Bedford) #40121 [64287e4d45] - (SEMVER-MAJOR) module: runtime deprecate trailing slash patterns (
Diverting trains of thought, wasting precious time Tue, 27 Aug 2024 How to really wrap a C compiler and preprocessor, really* * really Suppose we want to interfere with how a vaguely Unix-style C compiler does its job, and that we want to try compiling existing software with this modified compiler. Assuming the build system will let us do something like: CC=/path/to/my/wrapper make or CC=/path/to/
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
【2020年】CTF Web問題の攻撃手法まとめ - こんとろーるしーこんとろーるぶい
Building a tiny Linux from scratch
Writing a C compiler in 500 lines of Python
Python 3.10から導入されたBetter error messagesの深掘り | gihyo.jp
Building a Toy Programming Language in Python
Python 3.10の新機能：構造化パターンマッチング | gihyo.jp
0.8.0 Release Notes ⚡ The Zig Programming Language
Lean for JavaScript Developers — overreacted
So You Want To Remove The GVL?
January 2024 (version 1.86)
0.10.0 Release Notes ⚡ The Zig Programming Language
Large Text Compression Benchmark
June 2025 (version 1.102)
Rambles around computer science