{"id":31710,"date":"2019-10-31T21:42:39","date_gmt":"2019-10-31T18:42:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov\/"},"modified":"2019-10-31T21:42:39","modified_gmt":"2019-10-31T18:42:39","slug":"uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","title":{"rendered":"Sebezhet\u0151s\u00e9g az Adblock Plus-ban, amely lehet\u0151v\u00e9 teszi a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t k\u00e9rd\u00e9ses sz\u0171r\u0151k haszn\u00e1lata eset\u00e9n","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Az Adblock Plus rekl\u00e1mblokkol\u00f3ban identified<\/a><\/noindex> sebezhet\u0151s\u00e9g, lehet\u0151v\u00e9 teszi<\/a><\/noindex> JavaScript-k\u00f3d v\u00e9grehajt\u00e1sa a weboldalak kontextus\u00e1ban, ha nem ellen\u0151rz\u00f6tt sz\u0171r\u0151ket haszn\u00e1lnak, amelyeket rosszindulat\u00fa felhaszn\u00e1l\u00f3k k\u00e9sz\u00edtettek (p\u00e9ld\u00e1ul harmadik f\u00e9l szab\u00e1lyk\u00e9szletek csatlakoztat\u00e1s\u00e1val vagy a szab\u00e1lyok r\u00f6vid\u00edt\u00e9s\u00e9vel a MITM-t\u00e1mad\u00e1s sor\u00e1n).<\/p>\n

A sz\u0171r\u0151halmazok list\u00e1inak szerz\u0151i a saj\u00e1t k\u00f3djuk v\u00e9grehajt\u00e1s\u00e1t a felhaszn\u00e1l\u00f3k \u00e1ltal megnyitott weboldalak kontextus\u00e1ban szervezhetik, szab\u00e1lyok hozz\u00e1ad\u00e1s\u00e1val a « oper\u00e1tor seg\u00edts\u00e9g\u00e9vel.\u00e1t\u00edr\u00e1s<\/a><\/noindex>«, ami lehet\u0151v\u00e9 teszi a URL r\u00e9sz\u00e9nek cser\u00e9j\u00e9t. A rewrite oper\u00e1tor nem engedi meg a host cser\u00e9j\u00e9t az URL-ben, de szabad manipul\u00e1ci\u00f3t biztos\u00edt a k\u00e9r\u00e9si argumentumokkal. Csak sz\u00f6veg haszn\u00e1lhat\u00f3 cseremint\u00e1zatk\u00e9nt, script, object \u00e9s subdocument tagek helyettes\u00edt\u00e9se nem enged\u00e9lyezett. a k\u00fclf\u00f6ldi forgalmat, mik\u00f6zben mindenhol meg\u00e1ll az \u00e9let.<\/a><\/noindex>. <\/p>\n

Mindazon\u00e1ltal k\u00f3d v\u00e9grehajt\u00e1sa megker\u00fcl\u0151 \u00faton is megval\u00f3s\u00edthat\u00f3.
\nN\u00e9h\u00e1ny weboldal, bele\u00e9rtve a Google Maps-ot, Gmail-t \u00e9s Google Images-t, dinamikus JavaScript-blokkok v\u00e9grehajt\u00e1s\u00e1nak technik\u00e1j\u00e1t alkalmazza, amelyeket nyers sz\u00f6veg form\u00e1j\u00e1ban adnak \u00e1t. Ha a szerver lehet\u0151v\u00e9 teszi a k\u00e9r\u00e9selir\u00e1ny\u00edt\u00e1st, akkor a m\u00e1sik hosztra val\u00f3 \u00e1tt\u00e9r\u00e9s lehet\u0151v\u00e9 v\u00e1lik a URL param\u00e9terek megv\u00e1ltoztat\u00e1s\u00e1val (p\u00e9ld\u00e1ul a Google eset\u00e9ben az elir\u00e1ny\u00edt\u00e1st API-n kereszt\u00fcl lehet v\u00e9grehajtani a « oper\u00e1torral.google.com\/search<\/a><\/noindex>«). Az elir\u00e1ny\u00edt\u00e1st lehet\u0151v\u00e9 tev\u0151 hostok mellett a t\u00e1mad\u00e1s olyan szolg\u00e1ltat\u00e1sok ellen is ir\u00e1nyulhat, amelyek lehet\u0151v\u00e9 teszik a felhaszn\u00e1l\u00f3i tartalom elhelyez\u00e9s\u00e9t (k\u00f3dhostingok, cikkmegoszt\u00f3 platformok stb.).<\/p>\n

A javasolt t\u00e1mad\u00e1si m\u00f3dszer csak azokat az oldalakat \u00e9rinti, amelyek dinamikusan t\u00f6ltenek be JavaScript k\u00f3dsorokat (p\u00e9ld\u00e1ul XMLHttpRequest vagy Fetch r\u00e9v\u00e9n), majd v\u00e9grehajtj\u00e1k azokat. Egy m\u00e1sik fontos korl\u00e1toz\u00e1s, hogy elir\u00e1ny\u00edt\u00e1sra vagy tetsz\u0151leges adatok elhelyez\u00e9s\u00e9re van sz\u00fcks\u00e9g az alap\u00e9rtelmezett szerveren, amely a forr\u00e1st biztos\u00edtja. Mindazon\u00e1ltal, a t\u00e1mad\u00e1s aktualit\u00e1s\u00e1nak bemutat\u00e1sakor megmutathat\u00f3, hogyan lehet a saj\u00e1t k\u00f3d v\u00e9grehajt\u00e1s\u00e1t megszervezni a maps.google.com megnyit\u00e1sakor, a «google.com\/search» elir\u00e1ny\u00edt\u00e1s\u00e1nak felhaszn\u00e1l\u00e1s\u00e1val.<\/p>\n

A jav\u00edt\u00e1s jelenleg folyamatban van. A probl\u00e9ma a blokkol\u00f3kat is \u00e9rinti, AdBlock<\/a><\/noindex> \u00e9s uBlock<\/a><\/noindex>. A uBlock Origin blokkol\u00f3 nem \u00e9rintett a probl\u00e9m\u00e1ban, mivel nem t\u00e1mogatja a «rewrite» oper\u00e1tort. A uBlock Origin szerz\u0151je egy id\u0151ben
\nlemondott<\/a><\/noindex> a rewrite t\u00e1mogat\u00e1s\u00e1nak hozz\u00e1ad\u00e1sa a potenci\u00e1lis biztons\u00e1gi probl\u00e9m\u00e1kra \u00e9s a hoszton bel\u00fcli korl\u00e1toz\u00e1sok hi\u00e1nyoss\u00e1gaira hivatkozva (a rewrite helyett a querystrip opci\u00f3t javasolt\u00e1k a k\u00e9rd\u00e9sparam\u00e9terek tiszt\u00edt\u00e1s\u00e1ra ahelyett, hogy azokat lecser\u00e9ln\u00e9k).<\/p>\n

Az Adblock Plus fejleszt\u0151i szerint val\u00f3s t\u00e1mad\u00e1sok v\u00e9grehajt\u00e1sa val\u00f3sz\u00edn\u0171tlen, mivel az \u00f6sszes v\u00e1ltoztat\u00e1s a hivatalos szab\u00e1lylist\u00e1kban fel\u00fclvizsg\u00e1laton megy kereszt\u00fcl, \u00e9s a harmadik f\u00e9lt\u0151l sz\u00e1rmaz\u00f3 szab\u00e1lylist\u00e1k csatlakoztat\u00e1sa a felhaszn\u00e1l\u00f3k k\u00f6r\u00e9ben rendk\u00edv\u00fcl ritka. A szab\u00e1lyok MITM \u00e1ltali m\u00f3dos\u00edt\u00e1s\u00e1t kiz\u00e1rja a hivatalos szab\u00e1lylist\u00e1k HTTPS haszn\u00e1lat\u00e1nak alap\u00e9rtelmezett be\u00e1ll\u00edt\u00e1sa (a t\u00f6bbi lista eset\u00e9ben a j\u00f6v\u0151beli verzi\u00f3ban tervezik a HTTP let\u00f6lt\u00e9s\u00e9nek betilt\u00e1s\u00e1t). A weboldalak elleni t\u00e1mad\u00e1sok megakad\u00e1lyoz\u00e1s\u00e1ra direkt\u00edv\u00e1k alkalmazhat\u00f3k. CSP<\/a><\/noindex> (Content Security Policy), amelyeken kereszt\u00fcl kifejezetten meghat\u00e1rozhat\u00f3k azok a hosztok, ahonnan k\u00fcls\u0151 forr\u00e1sok bet\u00f6lt\u00e9se enged\u00e9lyezett. <\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0430\u0439\u0442\u043e\u0432, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b \u0438\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u0445\u043e\u0434\u0435 MITM-\u0430\u0442\u0430\u043a\u0438). \u0410\u0432\u0442\u043e\u0440\u044b \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441 \u043d\u0430\u0431\u043e\u0440\u0430\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 \u043c\u043e\u0433\u0443\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b \u0441 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u043c «rewrite«, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31710","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e9r\u00fcl\u00e9kenys\u00e9g az Adblock Plusban, amely lehet\u0151v\u00e9 teszi a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t gyan\u00fas sz\u0171r\u0151k haszn\u00e1lata eset\u00e9n | ProHoster","description":"Az Adblock Plus hirdet\u00e9sblokkol\u00f3ban s\u00e9r\u00fcl\u00e9kenys\u00e9get azonos\u00edtottak,","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Adblock Plus, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:39+00:00","article:modified_time":"2019-10-31T18:42:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31710","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:28:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:12:33","updated":"2026-01-21 07:28:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/31710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=31710"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/31710\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=31710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=31710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=31710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}