Reactã®`experimental_taintUniqueValue`ãããã©ãŒãã³ã¹ã«äžãã圱é¿ãæ¢ããŸããã»ãã¥ãªãã£å€ã®åŠçé床ã«çŠç¹ãåœãŠãããŒã¿æŽåæ§ã®åŒ·åãšã¢ããªã±ãŒã·ã§ã³æ§èœãžã®ã€ã³ãã¯ãã解説ã
React experimental_taintUniqueValueã®ããã©ãŒãã³ã¹ïŒã»ãã¥ãªãã£å€åŠçéåºŠã®æ·±æã
Reactã®experimental_taintUniqueValueã¯ãã¢ããªã±ãŒã·ã§ã³å
ã®ããŒã¿ã®ã»ãã¥ãªãã£ãšæŽåæ§ã匷åããããã®åŒ·åãªããŒã«ã§ãããã®æ©èœã¯ãReactãé²è¡äžã®å®éšçãªåãçµã¿ã®äžéšã§ãããéçºè
ã¯ç¹å®ã®å€ããæ±æãããŠããïŒtaintedïŒããšããŠããŒã¯ããããšãã§ããŸããããã¯ãç¹ã«ä¿¡é Œã§ããªãå¯èœæ§ã®ããå
¥åãæ±ãéã«ãç¹å¥ãªæ³šæãæãã¹ãã§ããããšãæå³ããŸãããã®ããã°èšäºã§ã¯ãexperimental_taintUniqueValueã䜿çšããããšã«ããããã©ãŒãã³ã¹ãžã®åœ±é¿ãç¹ã«ã»ãã¥ãªãã£å€ã®åŠçé床ã«çŠç¹ãåœãŠãŠè©³ãã解説ããŸãã
experimental_taintUniqueValueãçè§£ãã
ããã©ãŒãã³ã¹ã«ã€ããŠæãäžããåã«ãexperimental_taintUniqueValueãäœãããã®ããçè§£ããããšãéèŠã§ããæ¬è³ªçã«ãããã¯Reactã³ã³ããŒãã³ãå
ã®ããŒã¿ã«ãã€ã³ããã©ããã³ã°ïŒæ±æè¿œè·¡ïŒãé©çšããããã®ã¡ã«ããºã ã§ãããã€ã³ããã©ããã³ã°ã¯ãä¿¡é Œã§ããªããœãŒã¹ïŒäŸïŒãŠãŒã¶ãŒå
¥åãå€éšAPIïŒããæ¥ãããŒã¿ãæœåšçã«æªæã®ãããã®ãšããŠããŒã¯ããã»ãã¥ãªãã£æè¡ã§ããããããããšã§ããã®æ±æãããããŒã¿ãã¢ããªã±ãŒã·ã§ã³å
ãã©ã®ããã«æµããããç£èŠããé©åãªãµãã¿ã€ãºãæ€èšŒãªãã«æ©å¯æ§ã®é«ãæäœã§äœ¿çšãããã®ãé²ãããšãã§ããŸãã
ããã°ã®ã³ã¡ã³ãã»ã¯ã·ã§ã³ãæ§ç¯ããŠããã·ããªãªãèããŠã¿ãŸãããããŠãŒã¶ãŒãæçš¿ããã³ã¡ã³ãã«ã¯ãæªæã®ããã¹ã¯ãªããããã®ä»ã®æå®³ãªã³ã³ãã³ããå«ãŸããŠããå¯èœæ§ããããŸããé©åãªä¿è·çããªããã°ããã®ã³ã³ãã³ããã¢ããªã±ãŒã·ã§ã³ã«æ³šå
¥ãããã¯ãã¹ãµã€ãã¹ã¯ãªããã£ã³ã°ïŒXSSïŒã®è匱æ§ã«ã€ãªããå¯èœæ§ããããŸããexperimental_taintUniqueValueã¯ããŠãŒã¶ãŒãæçš¿ããã³ã¡ã³ããæ±æããããã®ãšããŠããŒã¯ã§ããããã«ããããšã§ããã®ãªã¹ã¯ã軜æžããã®ã«åœ¹ç«ã¡ãŸãããããŠãã³ã³ããŒãã³ãããªãŒå
šäœã§ãæ±æãããããŒã¿ããµãã¿ã€ãºãªãã§çŽæ¥DOMã«ã¬ã³ããªã³ã°ããããªã©ãæœåšçã«å±éºãªæ¹æ³ã§äœ¿çšãããŠããªããã確èªã§ããŸãã
experimental_taintUniqueValueã®ä»çµã¿
experimental_taintUniqueValueã®åºæ¬çãªã¡ã«ããºã ã¯ãéåžžãæ±æãããå€ã«é¢é£ä»ããããäžæã®èå¥åãŸãã¯ãã©ã°ã®äœæã䌎ããŸãããã®èå¥åã¯ãå€ãã³ã³ããŒãã³ãã颿°éã§æž¡ãããéã«ãå€ãšå
±ã«äŒæãããŸããæ±æãããå€ãæœåšçã«æ©å¯æ§ã®é«ãã³ã³ããã¹ãã§äœ¿çšããããšããã€ã³ããã©ã°ãååšãããã©ããã®ãã§ãã¯ãå®è¡ãããŸããååšããå Žåããµãã¿ã€ãºããšã¹ã±ãŒããªã©ã®é©åãªã»ãã¥ãªãã£å¯Ÿçãé©çšã§ããŸãã
以äžã¯ããã®äœ¿ç𿹿³ã®ç°¡åãªäŸã§ãã
import { experimental_taintUniqueValue, experimental_useTaintedValue } from 'react';
function Comment({ comment }) {
const taintedComment = experimental_taintUniqueValue(comment, 'user-submitted-comment');
const safeComment = experimental_useTaintedValue(taintedComment, (value) => {
// Sanitize or escape the value before rendering
return sanitize(value);
});
return <p>{safeComment}</p>;
}
ãã®äŸã§ã¯ãexperimental_taintUniqueValueãcommentããããã£ãæ±ææžã¿ãšããŠããŒã¯ããããããŠãŒã¶ãŒå
¥åã«ç±æ¥ããããšã瀺ããŠããŸããæ¬¡ã«ãexperimental_useTaintedValueããã®æ±æãããã³ã¡ã³ãã䜿çšãããµãã¿ã€ãºé¢æ°sanitizeã«æž¡ããŠãã¬ã³ããªã³ã°ããŠãå®å
šãªã³ã³ãã³ãã§ããããšãä¿èšŒããŸãã
泚æïŒ`experimental_useTaintedValue`颿°ããã³äžè¬çãªAPIã¯ãå®éšçãªAPIã®äžéšã§ããããã倿Žãããå¯èœæ§ããããŸãã
ããã©ãŒãã³ã¹ã«é¢ããèæ ®äºé
experimental_taintUniqueValueã¯è²Žéãªã»ãã¥ãªãã£äžã®å©ç¹ãæäŸããŸãããã¢ããªã±ãŒã·ã§ã³ã®ããã©ãŒãã³ã¹ãžã®åœ±é¿ãèæ
®ããããšãäžå¯æ¬ ã§ããæ°ããããŒã¿è¿œè·¡ãæ€èšŒã¡ã«ããºã ãå°å
¥ãããšããªãŒããŒãããã远å ãããå¯èœæ§ãããããããã®ãªãŒããŒããããã¢ããªã±ãŒã·ã§ã³ã®å¿çæ§ã«ã©ã®ããã«åœ±é¿ããããçè§£ããããšãéèŠã§ãã
ãã€ã³ããã©ããã³ã°ã®ãªãŒããŒããã
experimental_taintUniqueValueã®äž»ãªããã©ãŒãã³ã¹ãªãŒããŒãããã¯ã以äžã®èŠå ã«èµ·å ããŸãã
- å€ã®ã¿ã®ã³ã°ïŒ åæ±æãããå€ã«äžæã®èå¥åãŸãã¯ãã©ã°ãé¢é£ä»ããã«ã¯ã远å ã®ã¡ã¢ãªãšåŠçãå¿ èŠã§ãã
- äŒæïŒ ããŒã¿ãã³ã³ããŒãã³ãããªãŒãæµããéã«ãã€ã³ããã©ã°ãäŒæããããšãç¹ã«ããŒã¿ãå€ãã®ã³ã³ããŒãã³ããééããå ŽåããªãŒããŒãããã远å ãããå¯èœæ§ããããŸãã
- ãã€ã³ããã§ãã¯ïŒ å€ãæ±æãããŠãããã©ããã確èªããããã®ãã§ãã¯ãå®è¡ãããšãæœåšçã«æ©å¯æ§ã®é«ãæäœã«èšç®ã³ã¹ãã远å ãããŸãã
ã¬ã³ããªã³ã°ããã©ãŒãã³ã¹ãžã®åœ±é¿
experimental_taintUniqueValueãã¬ã³ããªã³ã°ããã©ãŒãã³ã¹ã«äžãã圱é¿ã¯ã以äžãå«ãããã€ãã®èŠå ã«äŸåããŸãã
- 䜿çšé »åºŠïŒ
experimental_taintUniqueValueã䜿çšããé »åºŠãé«ãã»ã©ãã¬ã³ããªã³ã°ããã©ãŒãã³ã¹ãžã®æœåšçãªåœ±é¿ã¯å€§ãããªããŸããã¢ããªã±ãŒã·ã§ã³ããŒã¿ã®ããäžéšã«ãã䜿çšããªãå Žåã圱é¿ã¯ããããããããããŸããã - ãã€ã³ããã§ãã¯ã®è€éãïŒ å€ãæ±æãããŠãããã©ããã倿ããããã«å®è¡ãããã§ãã¯ã®è€éãããããã©ãŒãã³ã¹ã«åœ±é¿ãäžããå¯èœæ§ããããŸãããã©ã°ãæ¯èŒãããªã©ã®åçŽãªãã§ãã¯ã¯ãããŒã¿å ã®ãã¿ãŒã³ãæ€çŽ¢ãããªã©ã®ããè€éãªãã§ãã¯ããã圱é¿ãå°ãªããªããŸãã
- ã³ã³ããŒãã³ãã®æŽæ°é »åºŠïŒ æ±æãããããŒã¿ãé »ç¹ã«æŽæ°ãããã³ã³ããŒãã³ãã§äœ¿çšãããå Žåããã€ã³ããã©ããã³ã°ã®ãªãŒããŒãããã¯å¢å¹ ãããŸãã
ããã©ãŒãã³ã¹ã®æž¬å®
ã¢ããªã±ãŒã·ã§ã³ã«ãããexperimental_taintUniqueValueã®ããã©ãŒãã³ã¹ãžã®åœ±é¿ãæ£ç¢ºã«è©äŸ¡ããããã«ã¯ã培åºçãªããã©ãŒãã³ã¹ãã¹ããå®è¡ããããšãäžå¯æ¬ ã§ããReactã¯ãããã©ãŒãã³ã¹ã枬å®ããããã®ããã€ãã®ããŒã«ãšãã¯ããã¯ãæäŸããŠããŸããããã«ã¯ä»¥äžãå«ãŸããŸãã
- React ProfilerïŒ React Profilerã¯ãReactã³ã³ããŒãã³ãã®ããã©ãŒãã³ã¹ã枬å®ã§ãããã©ãŠã¶æ¡åŒµæ©èœã§ããã©ã®ã³ã³ããŒãã³ããã¬ã³ããªã³ã°ã«æãæéãããã£ãŠãããããããŠãã®çç±ã«ã€ããŠã®æŽå¯ãæäŸããŸãã
- ããã©ãŒãã³ã¹ã¡ããªã¯ã¹ïŒ ãã¬ãŒã ã¬ãŒããCPU䜿çšçãªã©ã®ãã©ãŠã¶ã®ããã©ãŒãã³ã¹ã¡ããªã¯ã¹ã䜿çšããŠãã¢ããªã±ãŒã·ã§ã³ã®å šäœçãªããã©ãŒãã³ã¹ãè©äŸ¡ããããšãã§ããŸãã
- ãããã¡ã€ãªã³ã°ããŒã«ïŒ Chrome DevToolsã®Performanceã¿ããå°çšã®ãããã¡ã€ãªã³ã°ããŒã«ãªã©ã䜿çšãããšãCPU䜿çšçãã¡ã¢ãªå²ãåœãŠãã¬ããŒãžã³ã¬ã¯ã·ã§ã³ã«ã€ããŠããæ·±ãæŽå¯ãåŸãããšãã§ããŸãã
ããã©ãŒãã³ã¹ã枬å®ããéã¯ããã®åœ±é¿ãæç¢ºã«çè§£ããããã«ãexperimental_taintUniqueValueãæå¹ã«ããå Žåãšç¡å¹ã«ããå Žåã®äž¡æ¹ã§ãã¹ãããããã«ããŠãã ããããŸããçµæãå®éã®äœ¿çšç¶æ³ãæ£ç¢ºã«åæ ããããã«ãçŸå®çãªããŒã¿ã»ãããšãŠãŒã¶ãŒã·ããªãªã§ãã¹ãããŠãã ããã
experimental_taintUniqueValueã䜿çšããããã©ãŒãã³ã¹ã®æé©å
experimental_taintUniqueValueã¯ããã©ãŒãã³ã¹ã®ãªãŒããŒããããçºçãããå¯èœæ§ããããŸããããã®åœ±é¿ãæå°éã«æããããã«äœ¿çšã§ããããã€ãã®æŠç¥ããããŸãã
éžæçãªãã€ã³ã
å®éã«ä¿¡é Œã§ããªããœãŒã¹ããæ¥ãããŒã¿ã®ã¿ããã€ã³ãããŸããå éšã§çæãããããŒã¿ãããã§ã«æ€èšŒæžã¿ã®ããŒã¿ããã€ã³ãããããšã¯é¿ããŠãã ããã
äŸãã°ããŠãŒã¶ãŒãååãšã¡ãŒã«ã¢ãã¬ã¹ãå ¥åãããã©ãŒã ãèããŠã¿ãŸããããå ¥åãã£ãŒã«ãããã®ããŒã¿ã®ã¿ããã€ã³ããããã©ãŒã ã®ã©ãã«ããã®ä»ã®éçãªèŠçŽ ã¯ãã€ã³ããã¹ãã§ã¯ãããŸããã
é å»¶ãã€ã³ã
ããŒã¿ãå®éã«å¿ èŠã«ãªããŸã§ããã€ã³ããå»¶æããŸããæ©å¯æ§ã®é«ãæäœã§ããã«ã¯äœ¿çšãããªãããŒã¿ãããå Žåãäœ¿çšæç¹ã«è¿ã¥ããŸã§ãã€ã³ããåŸ ã€ããšãã§ããŸãã
ããšãã°ãAPIããããŒã¿ãåãåã£ãå Žåããããã¬ã³ããªã³ã°ãããçŽåãããŒã¿ããŒã¹ã¯ãšãªã§äœ¿çšãããçŽåãŸã§ããã€ã³ããåŸ ã€ããšãã§ããŸãã
ã¡ã¢å
ã¡ã¢åæè¡ã䜿çšããŠãäžå¿ èŠã«ããŒã¿ãåãã€ã³ãããã®ãé¿ããŸãããã§ã«å€ããã€ã³ãããå Žåããã®ãã€ã³ããããå€ãã¡ã¢ã«ä¿åããå ã®å€ãå€ãã£ãŠããªããã°åå©çšã§ããŸãã
Reactã¯ãReact.memoãuseMemoãªã©ãã¡ã¢åã广çã«å®è£
ããã®ã«åœ¹ç«ã€ããã€ãã®ã¡ã¢åããŒã«ãæäŸããŠããŸãã
å¹ççãªãã€ã³ããã§ãã¯
å€ãæ±æãããŠãããã©ããã倿ããããã«å®è¡ãããã§ãã¯ãæé©åããŸããå¯èœãªéããã·ã³ãã«ã§å¹ççãªãã§ãã¯ã䜿çšããŠãã ããã倧ããªåŠçãå¿ èŠãšããè€éãªãã§ãã¯ã¯é¿ããŠãã ããã
äŸãã°ãããŒã¿å ã®ãã¿ãŒã³ãæ€çŽ¢ãã代ããã«ãåã«ãã€ã³ããã©ã°ã®ååšã確èªããããšãã§ããŸãã
æŽæ°ã®ãããåŠç
äžåºŠã«è€æ°ã®å€ããã€ã³ãããå ŽåãæŽæ°ããããåŠçããŠåã¬ã³ããªã³ã°ã®åæ°ãæžãããŸããReactã¯å€ãã®å Žåãèªåçã«æŽæ°ããããåŠçããŸãããå¿
èŠãªå Žåã«ã¯ReactDOM.unstable_batchedUpdatesã䜿çšããŠæåã§æŽæ°ããããåŠçããããšãã§ããŸãã
ã³ãŒãåå²
ã³ãŒãåå²ãå®è£
ããŠãããŒãããã³è§£æãå¿
èŠãªJavaScriptã®éãæžãããŸããããã«ãããã¢ããªã±ãŒã·ã§ã³ã®åæããŒãæéãæ¹åãããexperimental_taintUniqueValueã®å
šäœçãªããã©ãŒãã³ã¹ãžã®åœ±é¿ã軜æžã§ããŸãã
Reactã¯ãåçã€ã³ããŒããReact.lazy APIãªã©ãããã€ãã®ã³ãŒãå岿è¡ãæäŸããŠããŸãã
å®äžçã®äŸãšèæ ®äºé
äŸ1ïŒEã³ããŒã¹ã®è£œåã¬ãã¥ãŒ
ãŠãŒã¶ãŒã補åã¬ãã¥ãŒãæçš¿ã§ããEã³ããŒã¹ãã©ãããã©ãŒã ãèããŠã¿ãŸãããããŠãŒã¶ãŒã¬ãã¥ãŒã¯æ¬è³ªçã«ä¿¡é Œã§ããªãããŒã¿ã§ãããXSSæ»æãé²ãããã«æ³šæããŠæ±ãå¿ èŠããããŸãã
ãŠãŒã¶ãŒãã¬ãã¥ãŒãæçš¿ãããšãã¬ãã¥ãŒã®ããã¹ãã¯çŽã¡ã«experimental_taintUniqueValueã䜿çšããŠãã€ã³ããããã¹ãã§ããã¬ãã¥ãŒããã¹ããã¢ããªã±ãŒã·ã§ã³å
ãæµããéã«ã補åããŒãžã«ã¬ãã¥ãŒãã¬ã³ããªã³ã°ããåãããŒã¿ããŒã¹ã«ä¿åããåã«ããã€ã³ããã§ãã¯ãå®è¡ããå¿
èŠããããŸãã
HTMLãšã¹ã±ãŒããDOMPurifyã®ãããªã©ã€ãã©ãªã䜿çšãããªã©ããµãã¿ã€ãºæè¡ãæ±æãããã¬ãã¥ãŒããã¹ãã«é©çšããŠãã¬ã³ããªã³ã°åã«æªæã®ããã³ãŒããåé€ãã¹ãã§ãã
äŸ2ïŒãœãŒã·ã£ã«ã¡ãã£ã¢ã®ã³ã¡ã³ãã·ã¹ãã
ãœãŒã·ã£ã«ã¡ãã£ã¢ãã©ãããã©ãŒã ã§ã¯ããŠãŒã¶ãŒãæ§ã ãªæçš¿ã«ã³ã¡ã³ããæçš¿ã§ããŸãããããã®ã³ã¡ã³ãã«ã¯ãURLãã¡ã³ã·ã§ã³ããã®ä»ã®æœåšçã«å±éºãªã³ã³ãã³ããå«ãŸããŠããããšããããããŸãã
ãŠãŒã¶ãŒãã³ã¡ã³ããæçš¿ãããšãã³ã¡ã³ãæååå šäœããã€ã³ããããã¹ãã§ããã³ã¡ã³ãã衚瀺ããåã«ãã¢ããªã±ãŒã·ã§ã³ã¯ãã€ã³ããã§ãã¯ãå®è¡ããé©åãªãµãã¿ã€ãºæè¡ãé©çšããå¿ èŠããããŸããäŸãã°ãURLã¯æ¢ç¥ã®æªæã®ãããŠã§ããµã€ãã®ãã©ãã¯ãªã¹ããšç §åããããŠãŒã¶ãŒã¡ã³ã·ã§ã³ã¯æå¹ãªãŠãŒã¶ãŒãåç §ããŠããããšã確èªããããã«æ€èšŒãããã¹ãã§ãã
äŸ3ïŒåœéåïŒi18nïŒ
åœéåã¯ããã°ãã°å€éšãã¡ã€ã«ãããŒã¿ããŒã¹ãã翻蚳ãèªã¿èŸŒãããšã䌎ããŸãããããã®ç¿»èš³ã¯æ¹ãããããå¯èœæ§ããããã»ãã¥ãªãã£ã®è匱æ§ã«ã€ãªããå¯èœæ§ããããŸãã
翻蚳ãèªã¿èŸŒãéã翻蚳æååã¯ãã€ã³ããããã¹ãã§ãã翻蚳æååã䜿çšããåã«ãæååã倿ŽãããŠããªãããšã確èªããããã«ãã€ã³ããã§ãã¯ãå®è¡ããå¿ èŠããããŸããæååãæ±æãããŠããå Žåã¯ããŠãŒã¶ãŒã«è¡šç€ºããåã«æ€èšŒãŸãã¯ãµãã¿ã€ãºãããã¹ãã§ãããã®æ€èšŒã«ã¯ãæ¢ç¥ã®æ£ããããŒãžã§ã³ãšæååãç §åããããæœåšçã«æå®³ãªæåãèªåçã«ãšã¹ã±ãŒããã翻蚳ã©ã€ãã©ãªã䜿çšãããããããšãå«ãŸããå ŽåããããŸãã
ã°ããŒãã«ãªèæ ®äºé
ã°ããŒãã«ãªã¢ããªã±ãŒã·ã§ã³ã§experimental_taintUniqueValueã䜿çšããéã¯ã以äžã®ç¹ãèæ
®ããããšãéèŠã§ãã
- æåãšã³ã³ãŒãã£ã³ã°ïŒ ã¢ããªã±ãŒã·ã§ã³ãç°ãªãæåãšã³ã³ãŒãã£ã³ã°ãæ£ããåŠçã§ããããã«ããŠãã ãããæªæã®ããæ»æè ã¯ãæåãšã³ã³ãŒãã£ã³ã°ã«é¢é£ããè匱æ§ãæªçšããŠãã€ã³ããã§ãã¯ãåé¿ããããšããå¯èœæ§ããããŸãã
- ããŒã«ãªãŒãŒã·ã§ã³ïŒ ç°ãªãå°åã«ãããç°ãªãæåçèŠç¯ãæåæ§ã«æ³šæããŠãã ãããç¹å®ã®åœã ã®ãŠãŒã¶ãŒã«ãšã£ãŠäžå¿«ãŸãã¯æå®³ãšãªãããã³ã³ãã³ãã®è¡šç€ºã¯é¿ããŠãã ããã
- æ³çã³ã³ãã©ã€ã¢ã³ã¹ïŒ ããŒã¿ã»ãã¥ãªãã£ãšãã©ã€ãã·ãŒã«é¢ãããã¹ãŠã®é©çšæ³èŠãéµå®ããŠãã ãããããã«ã¯ãå人ããŒã¿ãåéãŸãã¯åŠçããåã«ãŠãŒã¶ãŒã®åæãåŸãããšãå«ãŸããå ŽåããããŸãã
experimental_taintUniqueValueã®ä»£æ¿ææ®µ
experimental_taintUniqueValueã¯ãã€ã³ããã©ããã³ã°ã®ããã®åŒ·åãªã¡ã«ããºã ãæäŸããŸãããå©çšå¯èœãªå¯äžã®éžæè¢ã§ã¯ãããŸãããç¹å®ã®ããŒãºãèŠä»¶ã«å¿ããŠã次ã®ãããªä»£æ¿ã¢ãããŒããæ€èšããããšãã§ããŸãã
- å ¥åæ€èšŒïŒ å ç¢ãªå ¥åæ€èšŒãå®è£ ããŠãã¢ããªã±ãŒã·ã§ã³ã«å ¥ããã¹ãŠã®ããŒã¿ãæå¹ã§å®å šã§ããããšãä¿èšŒããŸããããã«ãããå€ãã®ã»ãã¥ãªãã£è匱æ§ãæªç¶ã«é²ãããšãã§ããŸãã
- åºåãšã³ã³ãŒãã£ã³ã°ïŒ HTMLãšã¹ã±ãŒããURLãšã³ã³ãŒãã£ã³ã°ãªã©ã®åºåãšã³ã³ãŒãã£ã³ã°æè¡ã䜿çšããŠãæªæã®ããã³ãŒããã¢ããªã±ãŒã·ã§ã³ã®åºåã«æ³šå ¥ãããã®ãé²ããŸãã
- ã³ã³ãã³ãã»ãã¥ãªãã£ããªã·ãŒïŒCSPïŒïŒ 匷åãªã³ã³ãã³ãã»ãã¥ãªãã£ããªã·ãŒãå®è£ ããŠãã¢ããªã±ãŒã·ã§ã³ãèªã¿èŸŒãããªãœãŒã¹ã®çš®é¡ãå¶éããŸããããã«ãããä¿¡é Œã§ããªãã¹ã¯ãªããã®å®è¡ãé²ããXSSæ»æãé²ãããšãã§ããŸãã
- ãµãŒãããŒãã£ã©ã€ãã©ãªïŒ DOMPurifyãOWASP Java HTML Sanitizerãªã©ã®ãµãŒãããŒãã£ã©ã€ãã©ãªãå©çšããŠãHTMLã³ã³ãã³ãããµãã¿ã€ãºããXSSæ»æãé²ããŸãã
çµè«
experimental_taintUniqueValueã¯ãReactã¢ããªã±ãŒã·ã§ã³ã«ãããããŒã¿ã®ã»ãã¥ãªãã£ãšæŽåæ§ã匷åããããã®è²ŽéãªããŒã«ã§ãããããããã®ããã©ãŒãã³ã¹ãžã®åœ±é¿ãæ
éã«èæ
®ããè³¢æã«äœ¿çšããããšãäžå¯æ¬ ã§ãããã€ã³ããã©ããã³ã°ã®ãªãŒããŒããããçè§£ããæé©åæŠç¥ãå®è£
ããããšã§ãã¢ããªã±ãŒã·ã§ã³ã®å¿çæ§ãžã®åœ±é¿ãæå°éã«æããããšãã§ããŸãã
experimental_taintUniqueValueãå®è£
ããéã¯ã培åºçãªããã©ãŒãã³ã¹ãã¹ããå®è¡ããç¹å®ã®ããŒãºãšèŠä»¶ã«åºã¥ããŠã¢ãããŒããé©å¿ãããŠãã ããããŸããå
¥åæ€èšŒãåºåãšã³ã³ãŒãã£ã³ã°ãªã©ãã»ãã¥ãªãã£è匱æ§ã«å¯Ÿããå
æ¬çãªé²åŸ¡ãæäŸããããã«ã代æ¿ã®ã»ãã¥ãªãã£å¯Ÿçãæ€èšããŠãã ããã
experimental_taintUniqueValueã¯ãŸã å®éšçãªæ©èœã§ããããããã®APIãåäœã¯å°æ¥ã®Reactã®ããŒãžã§ã³ã§å€æŽãããå¯èœæ§ããããŸããææ°ã®Reactã®ããã¥ã¡ã³ããšãã¹ããã©ã¯ãã£ã¹ãåžžã«ç¢ºèªãã广çãã€å®å
šã«äœ¿çšã§ããããã«ããŠãã ããã