기술문서:레퍼런스:보안:xss
차이
문서의 선택한 두 판 사이의 차이를 보여줍니다.
| 양쪽 이전 판 이전 판 다음 판 | 이전 판 | ||
|
기술문서:레퍼런스:보안:xss [2026/02/26 18:26] carlito76 |
기술문서:레퍼런스:보안:xss [2026/05/14 21:08] (현재) carlito76 |
||
|---|---|---|---|
| 줄 1: | 줄 1: | ||
| + | {{htmlmetatags> | ||
| + | metatag-description=(XSS, | ||
| + | metatag-og: | ||
| + | }} | ||
| + | |||
| ====== XSS ====== | ====== XSS ====== | ||
| <note warning> | <note warning> | ||
| - | XSS (Cross Site Scripting) 공격과 방어 | + | XSS (Cross Site Scripting) 공격과 방어\\ \\ |
| + | <color red> | ||
| </ | </ | ||
| 줄 18: | 줄 24: | ||
| | onanimationstart ((CSS 애니메이션)) | <span\\ onanimationstart=" | | onanimationstart ((CSS 애니메이션)) | <span\\ onanimationstart=" | ||
| | onappinstalled ((Progressive Web App)) ((< | | onappinstalled ((Progressive Web App)) ((< | ||
| - | | onauxclick ((포인터)) | <img\\ src="< | + | | onauxclick ((포인터)) | <img\\ src="< |
| | onbeforeactivate ((Internet Explorer / Edge Legacy)) ((포커스)) | <color gray> | | onbeforeactivate ((Internet Explorer / Edge Legacy)) ((포커스)) | <color gray> | ||
| | onbeforecopy ((클립보드)) | <span\\ onbeforecopy=" | | onbeforecopy ((클립보드)) | <span\\ onbeforecopy=" | ||
| 줄 37: | 줄 43: | ||
| | onbounce ((Internet Explorer / Edge Legacy)) ((< | | onbounce ((Internet Explorer / Edge Legacy)) ((< | ||
| | oncancel ((< | | oncancel ((< | ||
| - | | oncanplay ((미디어)) ((< | + | | oncanplay ((미디어)) ((< |
| - | | oncanplaythrough ((미디어)) ((< | + | | oncanplaythrough ((미디어)) ((< |
| | oncellchange ((Internet Explorer)) | <color gray> | | oncellchange ((Internet Explorer)) | <color gray> | ||
| | onchange ((< | | onchange ((< | ||
| | onchargingchange ((하드웨어)) | <color gray> | | onchargingchange ((하드웨어)) | <color gray> | ||
| - | | onclick ((포인터 / 키보드)) | <img\\ src="< | + | | onclick ((포인터 / 키보드)) | <img\\ src="< |
| | onclose ((< | | onclose ((< | ||
| | oncontentvisibilityautostatechange | <span\\ oncontentvisibilityautostatechange=" | | oncontentvisibilityautostatechange | <span\\ oncontentvisibilityautostatechange=" | ||
| | oncontextlost ((하드웨어)) | <color gray> | | oncontextlost ((하드웨어)) | <color gray> | ||
| - | | oncontextmenu ((포인터 / 키보드)) | <img\\ src="< | + | | oncontextmenu ((포인터 / 키보드)) | <img\\ src="< |
| | oncontextrestored ((하드웨어)) | <color gray> | | oncontextrestored ((하드웨어)) | <color gray> | ||
| | oncontrolselect ((Internet Explorer)) | <color gray> | | oncontrolselect ((Internet Explorer)) | <color gray> | ||
| 줄 52: | 줄 58: | ||
| | oncuechange ((< | | oncuechange ((< | ||
| | oncut ((클립보드)) | <span\\ oncut=" | | oncut ((클립보드)) | <span\\ oncut=" | ||
| + | | ondblclick ((포인터)) | <img\\ src="< | ||
| | ondeactivate ((Internet Explorer / Edge Legacy)) ((포커스)) | <color gray> | | ondeactivate ((Internet Explorer / Edge Legacy)) ((포커스)) | <color gray> | ||
| - | | ondblclick ((포인터)) | <img\\ src="< | ||
| | ondevicechange ((하드웨어)) | <color gray> | | ondevicechange ((하드웨어)) | <color gray> | ||
| | ondevicemotion ((하드웨어)) | <color gray> | | ondevicemotion ((하드웨어)) | <color gray> | ||
| 줄 65: | 줄 71: | ||
| | ondragstart ((드래그 앤 드롭)) | <color gray> | | ondragstart ((드래그 앤 드롭)) | <color gray> | ||
| | ondrop ((드래그 앤 드롭)) | <color gray> | | ondrop ((드래그 앤 드롭)) | <color gray> | ||
| - | | ondurationchange ((미디어)) ((< | + | | ondurationchange ((미디어)) ((< |
| + | | onemptied ((미디어)) ((< | ||
| | onend ((SVG 애니메이션)) | <svg width=" | | onend ((SVG 애니메이션)) | <svg width=" | ||
| - | | onended ((미디어)) ((< | + | | onended ((미디어)) ((< |
| | onerror | <img\\ src="" | | onerror | <img\\ src="" | ||
| | onerrorupdate ((Internet Explorer)) | <color gray> | | onerrorupdate ((Internet Explorer)) | <color gray> | ||
| 줄 85: | 줄 92: | ||
| | ongamepaddisconnected ((하드웨어)) | <color gray> | | ongamepaddisconnected ((하드웨어)) | <color gray> | ||
| | ongotpointercapture ((포인터)) | <color gray> | | ongotpointercapture ((포인터)) | <color gray> | ||
| - | | onhashchange | <color gray> | + | | onhashchange | <color gray> |
| | onhelp ((Internet Explorer)) | <color gray> | | onhelp ((Internet Explorer)) | <color gray> | ||
| | oninput | <input\\ oninput=" | | oninput | <input\\ oninput=" | ||
| 줄 95: | 줄 102: | ||
| | onlayoutcomplete ((Internet Explorer)) | <color gray> | | onlayoutcomplete ((Internet Explorer)) | <color gray> | ||
| | onlevelchange ((하드웨어)) | <color gray> | | onlevelchange ((하드웨어)) | <color gray> | ||
| - | | onload | <img\\ src="< | + | | onload | <img\\ src="< |
| - | | onloadeddata ((미디어)) ((< | + | | onloadeddata ((미디어)) ((< |
| - | | onloadedmetadata ((미디어)) ((< | + | | onloadedmetadata ((미디어)) ((< |
| - | | onloadstart ((미디어)) ((< | + | | onloadstart ((미디어)) ((< |
| | onlostpointercapture ((포인터)) | <color gray> | | onlostpointercapture ((포인터)) | <color gray> | ||
| | onmessage ((네트워크)) | <color gray> | | onmessage ((네트워크)) | <color gray> | ||
| | onmessageerror ((네트워크)) | <color gray> | | onmessageerror ((네트워크)) | <color gray> | ||
| - | | onmousedown ((마우스)) | <img\\ src="< | + | | onmousedown ((마우스)) | <img\\ src="< |
| - | | onmouseenter ((마우스)) | <img\\ src="< | + | | onmouseenter ((마우스)) | <img\\ src="< |
| - | | onmouseleave ((마우스)) | <img\\ src="< | + | | onmouseleave ((마우스)) | <img\\ src="< |
| - | | onmousemove ((마우스)) | <img\\ src="< | + | | onmousemove ((마우스)) | <img\\ src="< |
| - | | onmouseout ((마우스)) | <img\\ src="< | + | | onmouseout ((마우스)) | <img\\ src="< |
| - | | onmouseover ((마우스)) | <img\\ src="< | + | | onmouseover ((마우스)) | <img\\ src="< |
| - | | onmouseup ((마우스)) | <img\\ src="< | + | | onmouseup ((마우스)) | <img\\ src="< |
| - | | onmousewheel ((마우스)) | <img\\ src="< | + | | onmousewheel ((마우스)) | <img\\ src="< |
| | onmove ((Internet Explorer / Edge Legacy)) | <color gray> | | onmove ((Internet Explorer / Edge Legacy)) | <color gray> | ||
| | onmoveend ((Internet Explorer / Edge Legacy)) | <color gray> | | onmoveend ((Internet Explorer / Edge Legacy)) | <color gray> | ||
| 줄 121: | 줄 128: | ||
| | onpageshow ((< | | onpageshow ((< | ||
| | onpaste ((클립보드)) | <span\\ onpaste=" | | onpaste ((클립보드)) | <span\\ onpaste=" | ||
| - | | onpause ((미디어)) ((< | + | | onpause ((미디어)) ((< |
| - | | onplay ((미디어)) ((< | + | | onplay ((미디어)) ((< |
| - | | onplaying ((미디어)) ((< | + | | onplaying ((미디어)) ((< |
| | onpointercancel ((포인터)) | <color gray> | | onpointercancel ((포인터)) | <color gray> | ||
| - | | onpointerdown ((포인터)) | <img\\ src="< | + | | onpointerdown ((포인터)) | <img\\ src="< |
| - | | onpointerenter ((포인터)) | <img\\ src="< | + | | onpointerenter ((포인터)) | <img\\ src="< |
| - | | onpointerleave ((포인터)) | <img\\ src="< | + | | onpointerleave ((포인터)) | <img\\ src="< |
| - | | onpointermove ((포인터)) | <img\\ src="< | + | | onpointermove ((포인터)) | <img\\ src="< |
| - | | onpointerout ((포인터)) | <img\\ src="< | + | | onpointerout ((포인터)) | <img\\ src="< |
| - | | onpointerover ((포인터)) | <img\\ src="< | + | | onpointerover ((포인터)) | <img\\ src="< |
| - | | onpointerrawupdate ((포인터)) | <img\\ src="< | + | | onpointerrawupdate ((포인터)) | <img\\ src="< |
| - | | onpointerup ((포인터)) | <img\\ src="< | + | | onpointerup ((포인터)) | <img\\ src="< |
| | onpopstate | <color gray> | | onpopstate | <color gray> | ||
| | onpresentationconnectionavailable ((하드웨어)) | <color gray> | | onpresentationconnectionavailable ((하드웨어)) | <color gray> | ||
| - | | onprogress ((미디어)) ((< | + | | onprogress ((미디어)) ((< |
| | onpropertychange ((Internet Explorer / Edge Legacy)) | <color gray> | | onpropertychange ((Internet Explorer / Edge Legacy)) | <color gray> | ||
| - | | onratechange ((미디어)) ((< | + | | onratechange ((미디어)) ((< |
| | onreadystatechange ((비동기)) | <color gray> | | onreadystatechange ((비동기)) | <color gray> | ||
| | onrejectionhandled ((비동기)) | <color gray> | | onrejectionhandled ((비동기)) | <color gray> | ||
| 줄 154: | 줄 161: | ||
| | onsearch ((<input type=" | | onsearch ((<input type=" | ||
| | onsecuritypolicyviolation | <color gray> | | onsecuritypolicyviolation | <color gray> | ||
| - | | onseeked ((미디어)) ((< | + | | onseeked ((미디어)) ((< |
| - | | onseeking ((미디어)) ((< | + | | onseeking ((미디어)) ((< |
| | onselect ((< | | onselect ((< | ||
| | onselectionchange | <color gray> | | onselectionchange | <color gray> | ||
| 줄 161: | 줄 168: | ||
| | onshow ((Firefox)) | <color gray> | | onshow ((Firefox)) | <color gray> | ||
| | onslotchange | <color gray> | | onslotchange | <color gray> | ||
| - | | onstalled ((미디어)) ((< | + | | onstalled ((미디어)) ((< |
| | onstart ((Internet Explorer / Edge Legacy)) ((< | | onstart ((Internet Explorer / Edge Legacy)) ((< | ||
| | onstop ((Internet Explorer / Edge Legacy)) | <color gray> | | onstop ((Internet Explorer / Edge Legacy)) | <color gray> | ||
| | onstorage ((< | | onstorage ((< | ||
| | onsubmit ((< | | onsubmit ((< | ||
| - | | onsuspend ((미디어)) ((< | + | | onsuspend ((미디어)) ((< |
| - | | ontimeupdate ((미디어)) ((< | + | | ontimeupdate ((미디어)) ((< |
| | ontoggle ((< | | ontoggle ((< | ||
| | ontouchcancel ((터치)) | <color gray> | | ontouchcancel ((터치)) | <color gray> | ||
| - | | ontouchend ((터치)) | <img\\ src="< | + | | ontouchend ((터치)) | <img\\ src="< |
| - | | ontouchmove ((터치)) | <img\\ src="< | + | | ontouchmove ((터치)) | <img\\ src="< |
| - | | ontouchstart ((터치)) | <img\\ src="< | + | | ontouchstart ((터치)) | <img\\ src="< |
| | ontransitioncancel ((CSS 트랜지션)) | <color gray> | | ontransitioncancel ((CSS 트랜지션)) | <color gray> | ||
| | ontransitionend ((CSS 트랜지션)) | <color gray> | | ontransitionend ((CSS 트랜지션)) | <color gray> | ||
| 줄 180: | 줄 187: | ||
| | onunload ((< | | onunload ((< | ||
| | onvisibilitychange | <color gray> | | onvisibilitychange | <color gray> | ||
| - | | onvolumechange ((미디어)) ((< | + | | onvolumechange ((미디어)) ((< |
| | onvrdisplayactivate ((하드웨어)) | <color gray> | | onvrdisplayactivate ((하드웨어)) | <color gray> | ||
| | onvrdisplaydeactivate ((하드웨어)) | <color gray> | | onvrdisplaydeactivate ((하드웨어)) | <color gray> | ||
| - | | onwaiting ((미디어)) ((< | + | | onwaiting ((미디어)) ((< |
| | onwebkitanimationcancel ((WebKit 엔진)) | <color gray> | | onwebkitanimationcancel ((WebKit 엔진)) | <color gray> | ||
| | onwebkitanimationend ((WebKit 엔진)) | <color gray> | | onwebkitanimationend ((WebKit 엔진)) | <color gray> | ||
| 줄 200: | 줄 207: | ||
| | onwebkittransitionstart ((WebKit 엔진)) | <color gray> | | onwebkittransitionstart ((WebKit 엔진)) | <color gray> | ||
| | onwebkitwillrevealbottom ((WebKit 엔진)) | <color gray> | | onwebkitwillrevealbottom ((WebKit 엔진)) | <color gray> | ||
| - | | onwheel ((마우스)) | <img\\ src="< | + | | onwheel ((마우스)) | <img\\ src="< |
| | onzoom ((Internet Explorer)) | <color gray> | | onzoom ((Internet Explorer)) | <color gray> | ||
| ((https:// | ((https:// | ||
| + | |||
| + | ==== HTML Metadata Element ==== | ||
| + | ^ 속성 | ||
| + | | meta | <meta http-equiv=" | ||
| + | | link | <color gray> | ||
| + | | style | <color gray> | ||
| + | | base | <base href="< | ||
| + | |||
| + | ==== HTML Executable Element ==== | ||
| + | ^ 속성 | ||
| + | | script | < | ||
| + | | object | FIXME | | ||
| + | | embed | FIXME | | ||
| + | | applet | FIXME | | ||
| + | | svg | FIXME | | ||
| + | | iframe | FIXME | | ||
| + | | frame | FIXME | | ||
| + | |||
| + | ==== 페이징 이동 ==== | ||
| + | <sxh javascript; gutter: true;> | ||
| + | location.href=' | ||
| + | location.replace(' | ||
| + | location.assign(' | ||
| + | window.location=' | ||
| + | document.location=' | ||
| + | top.location= ' | ||
| + | parent.location=' | ||
| + | self.location=' | ||
| + | |||
| + | location[' | ||
| + | location[' | ||
| + | location[' | ||
| + | window[' | ||
| + | document[' | ||
| + | top[' | ||
| + | parent[' | ||
| + | self[' | ||
| + | |||
| + | location=' | ||
| + | window.open(' | ||
| + | </ | ||
| ===== 방어 ===== | ===== 방어 ===== | ||
| 줄 211: | 줄 259: | ||
| * " → " | * " → " | ||
| * ' → ' | * ' → ' | ||
| - | * DOMPurify 사용 | + | * DOMPurify |
| - | * CSP 설정 | + | * CSP (Content-Security Policy) |
| * HttpOnly 설정 | * HttpOnly 설정 | ||