鐃緒申鐃春わ申twitter XSS鐃竣わ申蓮鐃緒申佞鐃緒申鐃緒申twitter.com鐃熟使わ申覆鐃緒申鐃祝は遠くの祭わ申鐃緒申劼鐃緒申辰鐃緒申里任鐃緒申鐃緒申鐃緒申鐃緒申辰鐃緒申鐃緒申亮鐃緒申鐃緒申竜鐃緒申鐃淑ので￥申

Kazuho@Cybozu Labs: (Twitter 鐃緒申 XSS 鐃夙種申鐃緒申鐃祝器申連鐃緒申鐃緒申) 鐃緒申造鐃緒申鐃銃ワ申鐃緒申鐃夙わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃竣種申法鐃祝つわ申鐃緒申
鐃緒申鐃緒申鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃熟￥申鐃緒申鐃銃のルー鐃緒申鐃銃縁申鐃緒申鐃重�鐃術わ申鐃暑こ鐃夙でわ申鐃緒申

鐃緒申鐃緒申六鐃叔逸申覆鐃緒申鐃�(鐃緒申鐃緒申鐃初く)必鐃竣常申鐃叔わ申鐃獣ても十分鐃緒申鐃叔はわ申鐃緒申泙鐃緒申鐃�

鐃緒申鐃緒申鐃緒申鐃緒申(鐃緒申鐃淑りえ鐃緒申鐃緒申鐃緒申鐃緒申鐃�)鐃緒申鐃緒申表鐃緒申鐃緒申tweet鐃緒申parse鐃緒申鐃銃わ申鐃緒申鐃夙わ申鐃殉わ申鐃緒申

re_http = '(?:https?://[\\x21-\\x7e]+)';
re_user = '(?:[@][0-9A-Za-z_]{1,15})';
re_hashtag = '(?:[#]\\S+)';
re_entities = '(?:[<>&])';
re_tweet = new RegExp([re_http, re_user, re_hashtag, re_entities].join('|'), 'g');

鐃緒申鐃緒申鐃緒申鐃�

鐃淑駕申鐃緒申鐃緒申鐃銃のルー鐃緒申鐃銃縁申鐃緒申鐃重�鐃術わ申鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申辰僂鐃�XSS鐃夙なわ申泙鐃緒申鐃�

parse_tweet_wrong = function(s){
    return s.replace(re_tweet, function(m0){
        if (m0.match(/^[<>&]$/)){
            return {'<':'&lt;','>':'&gt;','&':'&amp;'}[m0];
        }if (m0.match(/^http/)){
            return '<a href="' + m0 + '">' + m0 + '</a>';
        }else if(m0.match(/^\@/)) {
            return '@<a href="http://twitter.com/'
                + m0.substr(1) + '">' + m0.substr(1) + '</a>';
        }else if(m0.match(/^\#/)) {
            return '<a href="http://twitter.com/search?q='
                + encodeURIComponent(m0) + '">' 
                + m0 + '</a>';
        }else{
            return m0;
        }
    });
};
Tweet:
Parsed:

鐃緒申文鐃塾最醐申離鐃藷クは￥申<a href="http://twitter.com/#@"onmouseover="alert(location.href)"/">鐃緒申</a>鐃緒申展鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申里任鐃緒申諭鐃�href鐃緒申"鐃緒申鐃縦わ申鐃緒申鐃緒申辰討鐃緒申鐃緒け鐃叔わ申鐃緒申鐃殉わ申鐃緒申鐃遵記鐃緒申鐃緒申鐃緒申表鐃緒申鐃熟￥申Mutually Exclusive鐃叔はわ申鐃緒申泙鐃緒申鐃�URI鐃緒申劼辰鐃緒申鐃緒申鐃緒申鐃緒申鐃宿緒申鐃緒申鐃緒申鐃渋常申鐃緒申鐃緒申鐃宿緒申鐃緒申鐃瞬逸申鐃淳刻申鐃緒申如廚鐃緒申泙鐃緒申箸鐃緒申鐃緒申鐃緒申箸任鐃緒申鐃�

鐃緒申鐃緒申鐃緒申

鐃竣わ申href鐃緒申鐃緒申法鐃�"鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃淑わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃駿わ申鐃緒申鐃獣てわ申鐃殉わ申鐃出￥申鐃瞬わ申鐃緒申鐃緒申404鐃淑ワ申鵐�」になわ申里任鐃緒申鐃緒申蕁�鐃緒申鐃緒申鐃緒申鐃緒申个茲わ申里任鐃緒申鐃�kazuho鐃緒申鐃緒申鐃�snippet鐃緒申(鐃緒申鐃緒申鐃初くHTML::Entities鐃緒申)encode_entities()鐃叔わ申鐃緒申鐃獣てわ申鐃緒申里任鐃緒申鐃緒申鐃緒申鐃盾き鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申鐃塾でわ申鐃緒申鐃緒申JavaScript鐃叔はどわ申鐃緒申鐃緒申个茲わ申任鐃緒申腓�?

鐃緒申鐃緒申兵蠅�鐃夙わ申鐃殉わ申鐃緒申


make_link = function(href, text) {
    var a = document.createElement('a');
    a.href = href;
    a.appendChild(document.createTextNode(text));
    var div = document.createElement('div');
    div.appendChild(a);
    return div.innerHTML;
};

parse_tweet_right = function(s) {
    return s.replace(re_tweet, function(m0) {
        if (m0.match(/^[<>&]$/)){
            return {'<':'&lt;','>':'&gt;','&':'&amp;'}[m0];
        }else if (m0.match(/^http/)) {
            return make_link(m0, m0);
        }else if (m0.match(/^\@/)) {
            return '@' + make_link(
                'http://twitter.com/' + m0.substr(1), m0.substr(1)
            );
        }else if (m0.match(/^\#/)) {
            return make_link(
                'http://twitter.com/search?q=' + encodeURIComponent(m0), m0
            );
        }else {
            return m0;
        }
    });
};
Tweet:
Parsed:

鐃緒申鐃緒申鐃緒申鐃�DOM Element鐃緒申鐃獣わ申鐃緒申鐃緒申鐃夙わ申鐃緒申个鐃緒申討鐃緒申鐃夙わ申鐃緒申鐃緒け鐃叔わ申鐃緒申

鐃緒申鐃緒申表鐃緒申鐃緒申("鐃緒申鐃緒申坦櫃鐃緒申討鐃緒申泙鐃緒申茲�鐃緒申)鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申覆鐃塾でも、鐃緒申鐃緒申鐃�XSS鐃緒申鐃宿わ申鐃緒申討鐃緒申泙鐃緒申鐃�

鐃縮のわ申鐃緒申鐃緒申鐃薯すわ申弌鐃�

鐃緒申鐃緒申鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申蓮鐃緒申鐃緒申辰鐃緒申鵑�わ申鐃緒申塙鐃渋わ申鐃緒申鐃�

鐃夙わ申鐃緒申鐃緒申鐃夙になわ申任鐃緒申腓�鐃緒申鐃緒申

Dan the Structured Programmer