{"id":31710,"date":"2019-10-31T21:42:39","date_gmt":"2019-10-31T18:42:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov\/"},"modified":"2019-10-31T21:42:39","modified_gmt":"2019-10-31T18:42:39","slug":"uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","title":{"rendered":"Zranite\u013enos\u0165 v Adblock Plus, ktor\u00e1 umo\u017e\u0148uje vykona\u0165 k\u00f3d pri pou\u017e\u00edvan\u00ed pochybn\u00e9ho filtra","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V blokova\u010di rekl\u00e1m Adblock Plus bola zisten\u00e1<\/a><\/noindex> zranite\u013enos\u0165, umo\u017e\u0148uj\u00faca<\/a><\/noindex> organizova\u0165 vykonanie JavaScriptov\u00e9ho k\u00f3du v kontexte str\u00e1nok, pri pou\u017e\u00edvan\u00ed neoveren\u00fdch filtrov, pripraven\u00fdch \u00fato\u010dn\u00edkmi (napr\u00edklad pri pripojen\u00ed na extern\u00e9 s\u00fabory pravidiel alebo cez zmenu pravidiel po\u010das MITM \u00fatoku).<\/p>\n

Autori zoznamov s filtrami m\u00f4\u017eu organizova\u0165 vykon\u00e1vanie svojho k\u00f3du v kontexte webov\u00fdch str\u00e1nok otvoren\u00fdch pou\u017e\u00edvate\u013emi prostredn\u00edctvom prid\u00e1vania pravidiel s oper\u00e1torom «rewrite<\/a><\/noindex>«, ktor\u00fd umo\u017e\u0148uje nahradi\u0165 \u010das\u0165 URL. Oper\u00e1tor rewrite nem\u00f4\u017ee nahradi\u0165 hostite\u013ea v URL, ale poskytuje mo\u017enos\u0165 vo\u013ene manipulova\u0165 s parametrami po\u017eiadavky. Ako maska na nahradenie je povolen\u00e9 pou\u017e\u00edva\u0165 iba text, a podstr\u010denie tagov script, object a subdocument je blokovan\u00e9<\/a><\/noindex>. <\/p>\n

Napriek tomu je mo\u017en\u00e9 dosiahnu\u0165 vykonanie k\u00f3du obch\u00e1dzac\u00edmi cestami.
\nNiektor\u00e9 webov\u00e9 str\u00e1nky, vr\u00e1tane Google Maps, Gmail a Google Images, pou\u017e\u00edvaj\u00fa techniku dynamick\u00e9ho na\u010d\u00edtania vykonate\u013en\u00fdch JavaScript blokov, ktor\u00e9 sa pren\u00e1\u0161aj\u00fa vo forme surov\u00e9ho textu. Ak server umo\u017e\u0148uje preposielanie po\u017eiadaviek, nahradenie in\u00e9ho hostite\u013ea m\u00f4\u017ee by\u0165 dosiahnut\u00e9 \u00fapravou parametrov URL (napr\u00edklad v kontexte Google m\u00f4\u017ee by\u0165 presmerovanie vykonan\u00e9 prostredn\u00edctvom API «google.com\/search<\/a><\/noindex>«). Okrem hostite\u013eov, ktor\u00ed umo\u017e\u0148uj\u00fa presmerovanie, m\u00f4\u017ee by\u0165 \u00fatok tie\u017e vykonan\u00fd vo\u010di slu\u017eb\u00e1m, ktor\u00e9 umo\u017e\u0148uj\u00fa umiestnenie obsahu pou\u017e\u00edvate\u013eov (hosting k\u00f3du, platformy na umiest\u0148ovanie \u010dl\u00e1nkov at\u010f.).<\/p>\n

Navrhnut\u00e1 met\u00f3da \u00fatoku sa t\u00fdka iba str\u00e1nok, ktor\u00e9 dynamicky na\u010d\u00edtavaj\u00fa riadky s JavaScript k\u00f3dom (napr\u00edklad cez XMLHttpRequest alebo Fetch) a n\u00e1sledne ich vykon\u00e1vaj\u00fa. \u010eal\u0161\u00edm d\u00f4le\u017eit\u00fdm obmedzen\u00edm je potreba pou\u017e\u00edva\u0165 presmerovanie alebo umiestnenie svojvo\u013en\u00fdch \u00fadajov na strane p\u00f4vodn\u00e9ho servera, ktor\u00fd poskytuje zdroj. Napriek tomu je ako demon\u0161tr\u00e1cia aktu\u00e1lnosti \u00fatoku uk\u00e1zan\u00e9, ako organizova\u0165 vykon\u00e1vanie svojho k\u00f3du pri otvoren\u00ed maps.google.com, pri\u010dom sa pou\u017e\u00edva presmerovanie cez «google.com\/search».<\/p>\n

Oprava je zatia\u013e v procese pr\u00edpravy. Probl\u00e9m sa tie\u017e t\u00fdka blokova\u010dov AdBlock<\/a><\/noindex> a uBlock<\/a><\/noindex>. Blokova\u010d uBlock Origin nie je problematick\u00fd, preto\u017ee nepodporuje oper\u00e1tor «rewrite». V minulosti autor uBlock Origin
\nsa vzdal<\/a><\/noindex> Prida\u0165 podporu rewrite, odvol\u00e1vaj\u00fac sa na potenci\u00e1lne probl\u00e9my s bezpe\u010dnos\u0165ou a nedostato\u010dn\u00e9 obmedzenia na \u00farovni hostite\u013ea (namiesto rewrite bola navrhnut\u00e1 mo\u017enos\u0165 querystrip na vy\u010distenie parametrov dopytu namiesto ich nahradenia).<\/p>\n

V\u00fdvoj\u00e1ri Adblock Plus pova\u017euj\u00fa vykonanie re\u00e1lnych \u00fatokov za nepravdepodobn\u00e9, preto\u017ee v\u0161etky zmeny v \u0161tandardn\u00fdch zoznamoch pravidiel prech\u00e1dzaj\u00fa recenziou a pripojenie tret\u00edch str\u00e1n zoznamov sa u pou\u017e\u00edvate\u013eov praktizuje mimoriadne zriedka. Zmenu pravidiel prostredn\u00edctvom MITM vylu\u010duje predvolen\u00e9 pou\u017eitie HTTPS na na\u010d\u00edtanie \u0161tandardn\u00fdch zoznamov blokovania (pre ostatn\u00e9 zoznamy sa pl\u00e1nuje zak\u00e1za\u0165 na\u010d\u00edtanie cez HTTP v bud\u00facej verzii). Na blokovanie \u00fatokov na strane str\u00e1nok m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 direkt\u00edvy CSP<\/a><\/noindex> (Content Security Policy), prostredn\u00edctvom ktor\u00fdch je mo\u017en\u00e9 jasne definova\u0165 hostite\u013eov, z ktor\u00fdch je povolen\u00e9 na\u010d\u00edtanie extern\u00fdch zdrojov. <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0430\u0439\u0442\u043e\u0432, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b \u0438\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u0445\u043e\u0434\u0435 MITM-\u0430\u0442\u0430\u043a\u0438). \u0410\u0432\u0442\u043e\u0440\u044b \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441 \u043d\u0430\u0431\u043e\u0440\u0430\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 \u043c\u043e\u0433\u0443\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b \u0441 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u043c «rewrite«, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31710","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v Adblock Plus, ktor\u00e1 umo\u017e\u0148uje vykonanie k\u00f3du pri pou\u017eit\u00ed pochybn\u00e9ho filtra | ProHoster","description":"V blokova\u010di rekl\u00e1m Adblock Plus bola zisten\u00e1 zranite\u013enos\u0165,","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Adblock Plus, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:39+00:00","article:modified_time":"2019-10-31T18:42:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31710","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:28:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:12:33","updated":"2026-01-21 07:28:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31710"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31710\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}