{"id":31710,"date":"2019-10-31T21:42:39","date_gmt":"2019-10-31T18:42:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov\/"},"modified":"2019-10-31T21:42:39","modified_gmt":"2019-10-31T18:42:39","slug":"uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","title":{"rendered":"Adblock Plus'i haavatavus, mis v\u00f5imaldab koodi k\u00e4ivitamist kahtlaste filtrite kasutamisel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Reklaamiblokeerijas Adblock Plus tuvastatud<\/a><\/noindex> haavatavus, mis v\u00f5imaldab<\/a><\/noindex> organiseerida JavaScript-koodi k\u00e4itamine veebisaitide kontekstis, kui kasutatakse kontrollimata filtreid, mida on valmistanud r\u00fcndajad (n\u00e4iteks kolmandate osapoolte reeglite kogumite \u00fchendamisel v\u00f5i reeglite asendamisel MITM-r\u00fcnnaku k\u00e4igus).<\/p>\n

Filtri kogumite autorid saavad korraldada oma koodi k\u00e4ivitamist kasutaja avatud saitide kontekstis, lisades reegleid operaatoriga «rewrite<\/a><\/noindex>«, mis v\u00f5imaldab asendada osa URL-ist. Rewrite operaator ei luba asendada URL-i hosti, kuid v\u00f5imaldab vabalt manipuleerida p\u00e4ringu argumentidega. Asendamiseks v\u00f5ib kasutada ainult tekstina ja script, object ja subdocument sildid ei ole lubatud. blokeeritud<\/a><\/noindex>. <\/p>\n

Siiski on koodi t\u00e4itmine v\u00f5imalik ringteed pidi.
\nM\u00f5ned saidid, sealhulgas Google Maps, Gmail ja Google Images, kasutavad d\u00fcnaamilise JavaScripti plokkide laadimise tehnikat, edastades neid palja tekstina. Kui server lubab p\u00e4ringute suunamist, on muudatuste tegemisega teise hostimise v\u00f5imaldamine v\u00f5imalik, kui asendada URL-i parameetreid (n\u00e4iteks Google kontekstis v\u00f5ib suunamist l\u00e4bi API «google.com\/search<\/a><\/noindex>«). Lisaks hostidele, mis lubavad suunamist, saab r\u00fcnnaku korraldada ka teenuste vastu, mis lubavad kasutajate loodud sisu (koodihostingud, artiklite avaldamise platvormid jne).<\/p>\n

Pakutud r\u00fcndemeetod m\u00f5jutab ainult lehti, mis laadivad d\u00fcnaamiliselt ridasid JavaScripti koodiga (nt XMLHttpRequesti v\u00f5i Fetchi kaudu) ja t\u00e4idavad need seej\u00e4rel. Teine oluline piirang on vajadus suunamise v\u00f5i suvaliste andmete paigutamise j\u00e4rele algse serveri poole, mis ressurssi edastab. Siiski on demonstratsioonina n\u00e4idatud, kuidas korraldada oma koodi k\u00e4ivitamist, avades maps.google.com, kasutades suunamist «google.com\/search».<\/p>\n

Parandus on praegu ettevalmistamisel. Probleem puudutab ka blokeerijaid AdBlock<\/a><\/noindex> ja uBlock<\/a><\/noindex>. Blokeerija uBlock Origin ei ole selle probleemi suhtes haavatav, kuna see ei toeta operaatorit «rewrite». Oma ajal autor uBlock Origin
\nkeeldus<\/a><\/noindex> lisama rewrite-toetust, viidates v\u00f5imalikele turvaprobleemidele ja hosti taseme piirangute ebapiisavusele (rewrite asemel pakuti querystripi v\u00f5imalust p\u00e4ringup\u00e4randite puhastamiseks nende asendamise asemel).<\/p>\n

Adblock Plus arendajad peavad reaalsete r\u00fcnnakute l\u00e4biviimist ebat\u00f5en\u00e4oliseks, kuna k\u00f5ik muudatused ametlikes reeglistikes l\u00e4bivad \u00fclevaatuse ning kolmandate osapoolte nimekirjade lisamine on kasutajate seas \u00e4\u00e4rmiselt haruldane. Reeglite asendamist MITM kaudu v\u00e4listab vaikimisi HTTPS-i kasutamine ametlike blokeerimisnimekirjade laadimisel (muude nimekirjade puhul plaanitakse tulevikus HTTP laadimist keelata). Saite r\u00fcnnakute eest kaitsmiseks v\u00f5ivad rakendada direktiive CSP<\/a><\/noindex> (Content Security Policy), mille kaudu saab selgelt m\u00e4\u00e4ratleda hostid, millelt lubatakse v\u00e4liste ressursside laadimist. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0430\u0439\u0442\u043e\u0432, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b \u0438\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u0445\u043e\u0434\u0435 MITM-\u0430\u0442\u0430\u043a\u0438). \u0410\u0432\u0442\u043e\u0440\u044b \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441 \u043d\u0430\u0431\u043e\u0440\u0430\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 \u043c\u043e\u0433\u0443\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b \u0441 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u043c «rewrite«, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31710","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Adblock Plus'is, mis v\u00f5imaldab koodi k\u00e4ivitada kaheldavate filtrite kasutamisel | ProHoster","description":"Reklaamiblokeerija Adblock Plus'is on tuvastatud haavatavus,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Adblock Plus, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:39+00:00","article:modified_time":"2019-10-31T18:42:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31710","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:28:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:12:33","updated":"2026-01-21 07:28:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=31710"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31710\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=31710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=31710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=31710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}