OWASP ZAP の finding を Rust/Axum の handler に戻して直す - じゃあ、おうちで学べる
はじめに vulnerable-app に ZAP の full scan を回すと、High finding が並びます。XSS、SQL Injection、Path Traversal。alert 名を眺めて、ふと気づく。これは「危険です」の一覧ではない。handler への差し戻し指示書だ。 OWASP ZAP を実行すると、HTML、Markdown、JSON のレポートが出ます。そこには Cross Site Scripting (Reflected)、SQL Injection、Path Traversal のような名前が並びます。ただ、alert 名だけを見ても修正は始まりません。必要なのは、finding を実際の handler、SQL、HTML 出力、ヘッダ設定に戻すことです。 OWASP ZAP は OSS の web 脆弱性スキャナで、HTTP リクエストを投げて挙
DuckDB has gone from a research project at CWI Amsterdam in 2019 to one of the most widely adopted databases of the past decade. The list of places it shows up is long: notebooks, ETL pipelines, dashboards, CI test runners, embedded analytics inside SaaS products, even an iPhone running TPC-H at scale factor 100. iPhone in a box of dry ice, running TPC-H. (source)Companies have started building re
In 2006 Microsoft conducted a customer survey to find what new features users want in new versions of Microsoft Office. To their surprise, more than 90% of what users asked for already existed, they just didn't know about it. To address the "discoverability" issue, they came up with the "Ribbon UI" that we know from Microsoft Office products today. Office is not unique in this sense. Most of us ar
Try Mastering Emacs for free! Are you struggling with the basics? Have you mastered movement and editing yet? When you have read Mastering Emacs you will understand Emacs. It’s that time again: there’s a new major version of Emacs and, with it, a treasure trove of new features and changes. Notable features include the formal inclusion of native compilation, a technique that will greatly speed up y
Noble Numbat Release Notes Table of Contents Introduction New features in 24.04 LTS Known Issues Official flavours More information Introduction These release notes for Ubuntu 24.04 LTS (Noble Numbat) provide an overview of the release and document the known issues with Ubuntu and its flavours. For details of the changes applied since 24.04, please see the 24.04.2 change summary. Support lifespan
Web scraping is the process of downloading data from a public website. For example, you could scrape ESPN for stats of baseball players and build a model to predict a team’s odds of winning based on their players stats and win rates. Below are a few use-cases for web scraping. Monitoring the prices of your competitors for price matching (competitive pricing). Collecting statistics from various web
Update 1.64.1: The update addresses these security issues. Update 1.64.2: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the January 2022 release of Visual Studio Code. There are many updates in this version that we hope you will like, some of the key highlights include: New Side Panel - Display more view
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
DuckDB Internals: Why is DuckDB Fast?
Lesser Known PostgreSQL Features
What's New in Emacs 28.1?
Ubuntu 24.04 LTS (Noble Numbat) Release Notes
How to Crawl the Web with Scrapy
January 2022 (version 1.64)