{"id":31710,"date":"2019-10-31T21:42:39","date_gmt":"2019-10-31T18:42:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov\/"},"modified":"2019-10-31T21:42:39","modified_gmt":"2019-10-31T18:42:39","slug":"uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","title":{"rendered":"Zranitelnost v Adblock Plus umo\u017e\u0148uje vykon\u00e1vat k\u00f3d p\u0159i vyu\u017e\u00edv\u00e1n\u00ed podez\u0159el\u00fdch filtr\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V blok\u00e1toru reklam Adblock Plus byla odhalena<\/a><\/noindex> zranitelnost, umo\u017e\u0148uje<\/a><\/noindex> umo\u017e\u0148uj\u00edc\u00ed prov\u00e1d\u011bt JavaScriptov\u00fd k\u00f3d v kontextu webov\u00fdch str\u00e1nek p\u0159i pou\u017eit\u00ed neov\u011b\u0159en\u00fdch filtr\u016f, kter\u00e9 p\u0159ipravili \u00fato\u010dn\u00edci (nap\u0159\u00edklad p\u0159i p\u0159ipojen\u00ed t\u0159et\u00edch sad pravidel nebo prost\u0159ednictv\u00edm zm\u011bny pravidel b\u011bhem MITM \u00fatoku).<\/p>\n

Auto\u0159i seznam\u016f s filtra\u010dn\u00edmi sadami mohou organizovat vykon\u00e1v\u00e1n\u00ed sv\u00e9ho k\u00f3du v kontextu otev\u00edran\u00fdch u\u017eivatelsk\u00fdch str\u00e1nek prost\u0159ednictv\u00edm p\u0159id\u00e1v\u00e1n\u00ed pravidel s oper\u00e1torem «rewrite<\/a><\/noindex>«, kter\u00fd umo\u017e\u0148uje nahradit \u010d\u00e1st URL. Oper\u00e1tor rewrite neumo\u017e\u0148uje zm\u011bnit hostitele v URL, ale d\u00e1v\u00e1 mo\u017enost voln\u011b manipulovat s argumenty dotazu. Jako maska pro n\u00e1hradu lze pou\u017e\u00edt pouze text, a vkl\u00e1d\u00e1n\u00ed tag\u016f script, object a subdocument zablokov\u00e1n<\/a><\/noindex>. <\/p>\n

Nicm\u00e9n\u011b prov\u00e1d\u011bn\u00ed k\u00f3du lze dos\u00e1hnout obchvatem.
\nN\u011bkter\u00e9 str\u00e1nky, v\u010detn\u011b Google Maps, Gmail a Google Images, pou\u017e\u00edvaj\u00ed techniku dynamick\u00e9ho na\u010d\u00edt\u00e1n\u00ed vykon\u00e1van\u00fdch blok\u016f JavaScriptu, kter\u00e9 jsou p\u0159ed\u00e1v\u00e1ny ve form\u011b hol\u00e9ho textu. Pokud server umo\u017e\u0148uje p\u0159esm\u011brov\u00e1n\u00ed dotaz\u016f, lze p\u0159esm\u011brov\u00e1n\u00ed na jin\u00e9ho hostitele dos\u00e1hnout zm\u011bnou parametr\u016f URL (nap\u0159\u00edklad v kontextu Google m\u016f\u017ee b\u00fdt p\u0159esm\u011brov\u00e1n\u00ed provedeno prost\u0159ednictv\u00edm API «google.com\/search<\/a><\/noindex>«). Krom\u011b hostitel\u016f, kte\u0159\u00ed povoluj\u00ed p\u0159esm\u011brov\u00e1n\u00ed, m\u016f\u017ee b\u00fdt \u00fatok proveden tak\u00e9 proti slu\u017eb\u00e1m, kter\u00e9 umo\u017e\u0148uj\u00ed um\u00eds\u0165ov\u00e1n\u00ed u\u017eivatelsk\u00e9ho obsahu (hostov\u00e1n\u00ed k\u00f3du, platformy pro um\u00eds\u0165ov\u00e1n\u00ed \u010dl\u00e1nk\u016f atd.).<\/p>\n

Navrhovan\u00e1 metoda \u00fatoku se t\u00fdk\u00e1 pouze str\u00e1nek, kter\u00e9 dynamicky na\u010d\u00edtaj\u00ed \u0159et\u011bzce s JavaScriptov\u00fdm k\u00f3dem (nap\u0159\u00edklad prost\u0159ednictv\u00edm XMLHttpRequest nebo Fetch) a pot\u00e9 je vykon\u00e1vaj\u00ed. Dal\u0161\u00edm d\u016fle\u017eit\u00fdm omezen\u00edm je nutnost pou\u017e\u00edt p\u0159esm\u011brov\u00e1n\u00ed nebo um\u00edst\u011bn\u00ed libovoln\u00fdch dat na stran\u011b p\u016fvodn\u00edho serveru, kter\u00fd poskytuje zdroj. Nicm\u00e9n\u011b, jako uk\u00e1zku relevance \u00fatoku je uk\u00e1z\u00e1no, jak organizovat vykon\u00e1v\u00e1n\u00ed sv\u00e9ho k\u00f3du p\u0159i otev\u0159en\u00ed maps.google.com, pomoc\u00ed p\u0159esm\u011brov\u00e1n\u00ed p\u0159es «google.com\/search».<\/p>\n

Oprava je zat\u00edm v procesu p\u0159\u00edpravy. Probl\u00e9m tak\u00e9 zasahuje do blok\u00e1tor\u016f AdBlock<\/a><\/noindex> a uBlock<\/a><\/noindex>Blok\u00e1tor uBlock Origin nen\u00ed t\u00edmto probl\u00e9mem posti\u017een, proto\u017ee nepodporuje oper\u00e1tor «rewrite». V minulosti autor uBlock Origin
\nodm\u00edtl<\/a><\/noindex> p\u0159id\u00e1n\u00ed podpory rewrite, s odkazem na potenci\u00e1ln\u00ed bezpe\u010dnostn\u00ed probl\u00e9my a nedostate\u010dn\u00e9 omezen\u00ed na \u00farovni hostitele (m\u00edsto rewrite byla navr\u017eena mo\u017enost querystrip pro \u010di\u0161t\u011bn\u00ed parametr\u016f dotazu nam\u00edsto jejich nahrazen\u00ed).<\/p>\n

V\u00fdvoj\u00e1\u0159i Adblock Plus pova\u017euj\u00ed prov\u00e1d\u011bn\u00ed skute\u010dn\u00fdch \u00fatok\u016f za nepravd\u011bpodobn\u00e9, proto\u017ee v\u0161echny zm\u011bny v standardn\u00edch pravidlech proch\u00e1zej\u00ed recenz\u00ed a p\u0159ipojen\u00ed extern\u00edch seznam\u016f praktikuje u\u017eivatel\u00e9 velmi z\u0159\u00eddka. Nahrazen\u00ed pravidel prost\u0159ednictv\u00edm MITM vylu\u010duje pou\u017eit\u00ed HTTPS jako v\u00fdchoz\u00edho pro na\u010d\u00edt\u00e1n\u00ed standardn\u00edch blokovac\u00edch seznam\u016f (pro ostatn\u00ed seznamy se pl\u00e1nuje zak\u00e1zat na\u010d\u00edt\u00e1n\u00ed p\u0159es HTTP v budouc\u00edm vyd\u00e1n\u00ed). Pro blokov\u00e1n\u00ed \u00fatok\u016f na stran\u011b server\u016f lze pou\u017e\u00edt direktivy CSP<\/a><\/noindex> (Content Security Policy), pomoc\u00ed kter\u00fdch lze explicitn\u011b definovat hostitele, ze kter\u00fdch je povoleno na\u010d\u00edt\u00e1n\u00ed extern\u00edch zdroj\u016f. <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0430\u0439\u0442\u043e\u0432, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b \u0438\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u0445\u043e\u0434\u0435 MITM-\u0430\u0442\u0430\u043a\u0438). \u0410\u0432\u0442\u043e\u0440\u044b \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441 \u043d\u0430\u0431\u043e\u0440\u0430\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 \u043c\u043e\u0433\u0443\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b \u0441 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u043c «rewrite«, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31710","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v Adblock Plus, kter\u00e1 umo\u017e\u0148uje vykon\u00e1n\u00ed k\u00f3du p\u0159i pou\u017eit\u00ed pochybn\u00e9ho filtru | ProHoster","description":"V blok\u00e1toru reklam Adblock Plus byla objevena zranitelnost,","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Adblock Plus, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:39+00:00","article:modified_time":"2019-10-31T18:42:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31710","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:28:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:12:33","updated":"2026-01-21 07:28:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31710"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31710\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}