Download as PDF, PPTX
![<script type="application/ld+json">
{
"@context": "http://schema.org/",
"@type": "Person",
"name": "Masakazu Fukami",
"job": “CTO",
"twitter": "@fukamiiiiinmin",
"company": “taskey inc.”,
"favorites": ["SEO", " "]
}
</script>](https://image.slidesharecdn.com/2019082735wearejavascripters-190828102543/85/20190827_-35_we_are_javascripters-5-320.jpg)
![2: HTML App
&HTML params
• Ruby on Rails
• <%= params[:page] %> <%==
params[:page] %> HTML](https://image.slidesharecdn.com/2019082735wearejavascripters-190828102543/85/20190827_-35_we_are_javascripters-41-320.jpg)
![host?page=[javascript]
• host?page=<script>alert(‘aaa’)</script>
• host?page=<script>document.body.inner
Text=' ';</
script>](https://image.slidesharecdn.com/2019082735wearejavascripters-190828102543/85/20190827_-35_we_are_javascripters-42-320.jpg)
Uploaded by将一 深見
20190827_#35_we_are_javascripters
This document discusses JavaScript SEO and cross-site scripting (XSS) vulnerabilities. It notes that Googlebot, the web crawler used by Google, now uses Chrome to render JavaScript for indexing purposes. However, this opens up the potential for XSS attacks that allow manipulation of Google's search index. The document provides examples of how XSS vulnerabilities in HTML applications or parameters could allow injecting JavaScript code that would be executed by Googlebot.
20190827_#35_we_are_javascripters
- 1.
- 2.
- 3.
- 4.
- 5. <script type="application/ld+json"> { "@context": "http://schema.org/", "@type":"Person", "name": "Masakazu Fukami", "job": “CTO", "twitter": "@fukamiiiiinmin", "company": “taskey inc.”, "favorites": ["SEO", " "] } </script>
- 6.
- 7.
- 11.
- 12.
- 13.
- 14. Google • SSR 1html • etc) wordpress • SPA ajax • etc) React, Vue
- 15. • SSR 1html • etc) wordpress • SPA ajax • etc) React, Vue SEO
- 16. • SSR 1html • etc) wordpress • SPA ajax • etc) React, Vue SEO
- 17.
- 18.
- 19.
- 20.
- 23.
- 25. • Google BotWRS Website Rendering System •
- 27.
- 28.
- 29.
- 30.
- 31.
- 32. Render Badget • Google •CSR • UGC SSR :
- 33.
- 34.
- 35.
- 36.
- 37.
- 38.
- 39. : XSS attackson Googlebot allow search index manipulation
- 40. 1: XSS • ChromeXSS XSS • open -na Google Chrome Canary --args -- disable-xss-auditor
- 41. 2: HTML App &HTMLparams • Ruby on Rails • <%= params[:page] %> <%== params[:page] %> HTML
- 42.
- 45.