기술문서:레퍼런스:보안:xss

차이

문서의 선택한 두 판 사이의 차이를 보여줍니다.

차이 보기로 링크

--- 기술문서:레퍼런스:보안:xss [2026/04/24 13:43]
carlito76
+++ 기술문서:레퍼런스:보안:xss [2026/05/14 21:08] (현재)
carlito76
@@ 줄 7: / 줄 7: @@
 <note warning>
-XSS (Cross Site Scripting) 공격과 방어
+XSS (Cross Site Scripting) 공격과 방어\\ \\
+<color red>**"본 문서의 예시는 학습용입니다. 반드시 테스트 환경에서만 사용하세요."**</color>
 </note>
@@ 줄 209: / 줄 210: @@
 | onzoom ((Internet Explorer)) |  <color gray>-</color>  | |
 ((https://www.w3schools.com/tags/ref_eventattributes.asp)) ((https://html.spec.whatwg.org/multipage/webappapis.html#event-handlers-on-elements,-document-objects,-and-window-objects))
+==== HTML Metadata Element ====
+^  속성  ^  예시  ^
+| meta | <meta http-equiv="refresh" content="0;url=<nowiki>https://example.com</nowiki>"> |
+| link |  <color gray>-</color>  |
+| style |  <color gray>-</color>  |
+| base | <base href="<nowiki>https://example.com</nowiki>"> |
+==== HTML Executable Element ====
+^  속성  ^  예시  ^
+| script | <script>alert('attack')</script> |
+| object | FIXME |
+| embed | FIXME |
+| applet | FIXME |
+| svg | FIXME |
+| iframe | FIXME |
+| frame | FIXME |
 ==== 페이징 이동 ====
-  * location.href='<nowiki>https://example.com</nowiki>'
+<sxh javascript; gutter: true;>
-  * location.replace('<nowiki>https://example.com</nowiki>')
+location.href='https://example.com'
-  * location.assign('<nowiki>https://example.com</nowiki>')
+location.replace('https://example.com')
-  * window.location='<nowiki>https://example.com</nowiki>'
+location.assign('https://example.com')
-  * document.location='<nowiki>https://example.com</nowiki>'
+window.location='https://example.com'
-  * top.location= '<nowiki>https://example.com</nowiki>'
+document.location='https://example.com'
-  * parent.location='<nowiki>https://example.com</nowiki>'
+top.location= 'https://example.com'
-  * self.location='<nowiki>https://example.com</nowiki>'
+parent.location='https://example.com'
-  * location['href']='<nowiki>https://example.com</nowiki>'
+self.location='https://example.com'
-  * location['replace']('<nowiki>https://example.com</nowiki>')
-  * location['assign']('<nowiki>https://example.com</nowiki>')
+location['href']='https://example.com'
-  * window['location']='<nowiki>https://example.com</nowiki>'
+location['replace']('https://example.com')
-  * document['location']='<nowiki>https://example.com</nowiki>'
+location['assign']('https://example.com')
-  * top['location']='<nowiki>https://example.com</nowiki>'
+window['location']='https://example.com'
-  * parent['location']='<nowiki>https://example.com</nowiki>'
+document['location']='https://example.com'
-  * self['location']='<nowiki>https://example.com</nowiki>'
+top['location']='https://example.com'
-  * location='<nowiki>https://example.com</nowiki>'
+parent['location']='https://example.com'
-  * window.open('<nowiki>https://example.com</nowiki>', '_self')
+self['location']='https://example.com'
+location='https://example.com'
+window.open('https://example.com', '_self')
+</sxh>
 ===== 방어 =====
@@ 줄 238: / 줄 260: @@
     * ' → &apos;
   * DOMPurify ((https://github.com/cure53/DOMPurify)) 사용
-  * CSP 설정
+  * CSP (Content-Security Policy) 설정
   * HttpOnly 설정