{"id":83951,"date":"2022-07-30T22:14:16","date_gmt":"2022-07-30T20:14:16","guid":{"rendered":"https:\/\/rmarketingdigital.com\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/"},"modified":"2020-09-17T04:35:48","modified_gmt":"2020-09-17T07:35:48","slug":"evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza","status":"publish","type":"post","link":"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/","title":{"rendered":"\u00c9vitez les vuln\u00e9rabilit\u00e9s de script intersite bas\u00e9es sur DOM avec des types approuv\u00e9s"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table des mati\u00e8res<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Basculer la table des mati\u00e8res\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Basculer<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewbox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewbox=\"0 0 24 24\" version=\"1.2\" baseprofile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#%C2%BFPor-que-deberia-preocuparte\" >Pourquoi devriez-vous vous en soucier?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Antecedentes\" >Ant\u00e9c\u00e9dents<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Introduccion-a-la-API\" >Introduction \u00e0 l&#039;API<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Como-utilizar-los-tipos-de-confianza\" >Comment utiliser les types d&#039;approbation<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Preparese-para-los-informes-de-infraccion-de-la-politica-de-seguridad-de-contenido\" >Pr\u00e9parer les rapports de violation de politique de s\u00e9curit\u00e9 du contenu<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Identificar-infracciones-de-tipos-de-confianza\" >Identifier les violations de type de confiance<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Arregle-las-infracciones\" >Corrigez les infractions<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Reescribe-el-codigo-ofensivo\" >R\u00e9\u00e9crire le code incrimin\u00e9<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Usa-una-biblioteca\" >Utiliser une biblioth\u00e8que<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Cree-una-politica-de-tipo-de-confianza\" >Cr\u00e9er une strat\u00e9gie de type d&#039;approbation<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Utilice-una-politica-predeterminada\" >Utiliser une politique par d\u00e9faut<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Cambiar-para-hacer-cumplir-la-Politica-de-seguridad-del-contenido\" >Changement pour appliquer la politique de s\u00e9curit\u00e9 du contenu<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/evite-las-vulnerabilidades-de-secuencias-de-comandos-entre-sitios-basadas-en-dom-con-los-tipos-de-confianza\/#Otras-lecturas\" >Autres lectures<\/a><\/li><\/ul><\/nav><\/div>\n<p><\/p>\n<div>\n<header class=\"w-article-header\">\n<p class=\"w-article-header__subhead w-mb--non\">\n<p>          R\u00e9duisez la surface d&#039;attaque DOM XSS de votre application.\n        <\/p>\n<p>\n          <time>25 mars 2020<\/time><\/p>\n<div class=\"w-layout-container--narrow w-post-signpost\">\n  <span class=\"w-post-signpost__title\">Il appara\u00eet dans:<\/span><br \/>\n  S\u00fbr et s\u00e9curis\u00e9\n<\/div>\n<\/header>\n<h2 id=\"why-should-you-care\"><span class=\"ez-toc-section\" id=\"%C2%BFPor-que-deberia-preocuparte\"><\/span>Pourquoi devriez-vous vous en soucier? <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Le script intersite bas\u00e9 sur DOM (DOM XSS) est l&#039;une des vuln\u00e9rabilit\u00e9s de s\u00e9curit\u00e9 Web les plus courantes et il est tr\u00e8s facile de l&#039;introduire dans votre application. <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/github.com\/w3c\/webappsec-trusted-types\">Types de confiance<\/a><br \/>\nVous donnant les outils pour \u00e9crire, v\u00e9rifier la s\u00e9curit\u00e9 et prot\u00e9ger les applications des vuln\u00e9rabilit\u00e9s DOM XSS en s\u00e9curisant par d\u00e9faut les fonctions API Web dangereuses. Les types de confiance sont compatibles avec Chrome 83 et <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/github.com\/w3c\/webappsec-trusted-types#polyfill\">polyfill<\/a> il est disponible pour d&#039;autres navigateurs. Regarder <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/es\/docs\/Web\/HTTP\/Headers\/Content-Security-Policy\/trusted-types#Browser_compatibility\">Compatibilit\u00e9 du navigateur<\/a> pour obtenir des informations \u00e0 jour sur la compatibilit\u00e9 entre navigateurs.<\/p>\n<div class=\"w-aside w-aside--key-term\">\n<p><strong>Terme cl\u00e9:<\/strong><br \/>\nLes scripts intersites bas\u00e9s sur DOM se produisent lorsque les donn\u00e9es d&#039;un utilisateur contr\u00f4lent<br \/>\n<em>Fontaine<\/em> (comme le nom d&#039;utilisateur ou l&#039;URL de redirection extraite de l&#039;extrait d&#039;URL) atteint un <em>couler<\/em>, qui est une fonction comme <code>eval ()<\/code> ou un cr\u00e9ateur de propri\u00e9t\u00e9 comme<br \/>\n<code>.innerHTML<\/code>, qui peut ex\u00e9cuter du code JavaScript arbitraire.<\/p>\n<\/div>\n<h2 id=\"background\"><span class=\"ez-toc-section\" id=\"Antecedentes\"><\/span>Ant\u00e9c\u00e9dents <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Pendant de nombreuses ann\u00e9es <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/owasp.org\/www-community\/attacks\/xss\/\">DOM XSS<\/a><br \/>\nil s&#039;agit de l&#039;une des vuln\u00e9rabilit\u00e9s de s\u00e9curit\u00e9 Web les plus fr\u00e9quentes et les plus dangereuses.<\/p>\n<p>Il existe deux groupes distincts de scripts intersites. Certaines vuln\u00e9rabilit\u00e9s XSS sont caus\u00e9es par un code c\u00f4t\u00e9 serveur cr\u00e9ant de mani\u00e8re non s\u00e9curis\u00e9e le code HTML qui compose le site Web. D&#039;autres ont une cause fondamentale dans le client, o\u00f9 le code JavaScript appelle des fonctions dangereuses avec un contenu contr\u00f4l\u00e9 par l&#039;utilisateur.<\/p>\n<p>\u00c0 <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\">\u00e9viter XSS c\u00f4t\u00e9 serveur<\/a>Veuillez ne pas g\u00e9n\u00e9rer de HTML par concat\u00e9nation de cha\u00eenes et utiliser des biblioth\u00e8ques de mod\u00e8les s\u00e9curis\u00e9es avec \u00e9chappement automatique contextuel. Utiliser un <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/csp.withgoogle.com\/docs\/strict-csp.html\">Politique de s\u00e9curit\u00e9 du contenu non bas\u00e9e sur la s\u00e9curit\u00e9<\/a> pour une att\u00e9nuation suppl\u00e9mentaire contre les erreurs qui se produisent in\u00e9vitablement.<\/p>\n<p>D\u00e9sormais, un navigateur peut \u00e9galement aider \u00e0 emp\u00eacher le XSS c\u00f4t\u00e9 client (\u00e9galement bas\u00e9 sur DOM) avec <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/bit.ly\/trusted-types\">Types de confiance<\/a>.<\/p>\n<h2 id=\"api-introduction\"><span class=\"ez-toc-section\" id=\"Introduccion-a-la-API\"><\/span>Introduction \u00e0 l&#039;API <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Les types d&#039;approbation fonctionnent en bloquant les fonctions de puits de risque suivantes. Vous pouvez d\u00e9j\u00e0 reconna\u00eetre certains d&#039;entre eux, tels que les fournisseurs de navigateurs et <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/reactjs.org\/docs\/dom-elements.html#dangerouslysetinnerhtml\">cadres Web<\/a> vous emp\u00eache d\u00e9j\u00e0 d&#039;utiliser ces fonctionnalit\u00e9s pour des raisons de s\u00e9curit\u00e9.<\/p>\n<ul>\n<li>\n<p><strong>Manipulation de script<\/strong>:<br \/><a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTML\/Element\/script#attr-src\"><code><\/code><\/a>  et configurer le contenu textuel de <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTML\/Element\/script\"><code><\/code><\/a>  \u00e9l\u00e9ments.<\/p>\n<\/li>\n<li>\n<p><strong>G\u00e9n\u00e9rer du HTML \u00e0 partir d&#039;une cha\u00eene<\/strong>:<\/p>\n<p><a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Element\/innerHTML\"><code>innerHTML<\/code><\/a>, <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Element\/outerHTML\"><code>externeHTML<\/code><\/a>,<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Element\/insertAdjacentHTML\"><code>insertAdjacentHTML<\/code><\/a>,<br \/>\n<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTML\/Element\/iframe#attr-srcdoc\"><code><iframe>srcdoc<\/code><\/a>,<br \/>\n<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Document\/write\"><code>document.write<\/code><\/a>, <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Document\/writeln\"><code>document.writeln<\/code><\/a>y <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/DOMParser#DOMParser.parseFromString\"><code>DOMParser.parseFromString<\/code><\/a><\/p>\n<\/li>\n<li>\n<p><strong>Ex\u00e9cuter le contenu du plugin<\/strong>:<br \/><a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTML\/Element\/embed#attr-src\"><code><\/code><\/a>, <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTML\/Element\/object#attr-data\"><code><object><\/code><\/a>  y <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTML\/Element\/object#attr-codebase\"><code><object><\/code><\/a><\/p>\n<\/li>\n<li>\n<p><strong>Compilation du code JavaScript au moment de l&#039;ex\u00e9cution<\/strong>: <br \/><code>\u00e9valuer<\/code>, <code>setTimeout<\/code>, <code>setInterval<\/code>, <code>nouvelle fonction ()<\/code><\/p>\n<\/li>\n<\/ul>\n<p>Les types de confiance n\u00e9cessitent que vous traitiez les donn\u00e9es avant de les transmettre aux fonctions de r\u00e9cepteur ci-dessus. Le simple fait d&#039;utiliser une cha\u00eene \u00e9chouera, car le navigateur ne sait pas si les donn\u00e9es sont fiables:<\/p>\n<figure class=\"w-compare\">\n<p class=\"w-compare__label w-compare__label--worse\">\n<p>    Pas\n  <\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-javascript\"><code class=\"language-javascript\">anElement<span class=\"token punctuation\">.<\/span>innerHTML  <span class=\"token operator\">=<\/span> location<span class=\"token punctuation\">.<\/span>href<span class=\"token punctuation\">;<\/span><\/code><\/pre>\n<p><\/web-copy-code><figcaption class=\"w-compare__caption\">\n<p>  Lorsque les types approuv\u00e9s sont activ\u00e9s, le navigateur lance un <em>Faute de frappe<\/em> et \u00e9vitez d&#039;utiliser un r\u00e9cepteur DOM XSS avec une cha\u00eene. <\/p>\n<\/figcaption><\/figure>\n<p>Pour indiquer que les donn\u00e9es ont \u00e9t\u00e9 trait\u00e9es de mani\u00e8re s\u00e9curis\u00e9e, cr\u00e9ez un objet sp\u00e9cial: un type de confiance.<\/p>\n<figure class=\"w-compare\">\n<p class=\"w-compare__label w-compare__label--better\">\n<p>    Faire\n  <\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-javascript\"><code class=\"language-javascript\">anElement<span class=\"token punctuation\">.<\/span>innerHTML <span class=\"token operator\">=<\/span> aTrustedHTML<span class=\"token punctuation\">;<\/span><\/code><\/pre>\n<p><\/web-copy-code><figcaption class=\"w-compare__caption\">\n<p>  Lorsque les types de confiance sont activ\u00e9s, le navigateur accepte un <code>TrustedHTML<\/code> objet pour les \u00e9couteurs qui attendent des extraits de code HTML. Il y a aussi <code>TrustedScript<\/code> y <code>TrustedScriptURL<\/code> Objets pour autres puits sensibles. <\/p>\n<\/figcaption><\/figure>\n<p>Les types de confiance r\u00e9duisent consid\u00e9rablement le DOM XSS <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Attack_surface\">surface d&#039;attaque<\/a><br \/>\nde votre application. Il simplifie les contr\u00f4les de s\u00e9curit\u00e9 et vous permet d&#039;appliquer des contr\u00f4les de s\u00e9curit\u00e9 bas\u00e9s sur le type qui sont effectu\u00e9s lors de la compilation, de la liaison ou de l&#039;empaquetage de votre code au moment de l&#039;ex\u00e9cution, dans le navigateur.<\/p>\n<h2 id=\"how-to-use-trusted-types\"><span class=\"ez-toc-section\" id=\"Como-utilizar-los-tipos-de-confianza\"><\/span>Comment utiliser les types d&#039;approbation <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"prepare-for-content-security-policy-violation-reports\"><span class=\"ez-toc-section\" id=\"Preparese-para-los-informes-de-infraccion-de-la-politica-de-seguridad-de-contenido\"><\/span>Pr\u00e9parer les rapports de violation de politique de s\u00e9curit\u00e9 du contenu <span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Vous pouvez impl\u00e9menter un collecteur de rapports (tel que celui open source <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/github.com\/jacobbednarz\/go-csp-collector\">go-csp-collector<\/a>) ou utilisez l&#039;un des \u00e9quivalents commerciaux. Vous pouvez \u00e9galement d\u00e9boguer les violations dans le navigateur:<\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-js\"><code class=\"language-js\">la fen\u00eatre<span class=\"token punctuation\">.<\/span><span class=\"token function\">addEventListener<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">'securitypolicyviolation'<\/span><span class=\"token punctuation\">,<\/span><br>console<span class=\"token punctuation\">.<\/span><span class=\"token function\">Erreur<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">bind<\/span><span class=\"token punctuation\">(<\/span>console<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/code><\/pre>\n<p><\/web-copy-code><\/p>\n<p>Ajoutez l&#039;en-t\u00eate de r\u00e9ponse HTTP suivant aux documents que vous souhaitez migrer vers des types approuv\u00e9s.<\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-text\"><code class=\"language-text\">Content-Security-Policy-Report-Only: require-trusted-types-for &#039;script&#039;; report-uri \/\/my-csp-endpoint.example<\/code><\/pre>\n<p><\/web-copy-code><\/p>\n<p>D\u00e9sormais, toutes les violations sont signal\u00e9es \u00e0 <code>\/\/my-csp-endpoint.example<\/code>, mais le site Web fonctionne toujours. La section suivante explique comment <code>\/\/my-csp-endpoint.example<\/code> emplois.<\/p>\n<div class=\"w-aside w-aside--caution\">\n<p><strong>Mise en garde:<\/strong><br \/>\nLes types d&#039;approbation ne sont disponibles que dans <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Secure_Contexts\">contexte s\u00fbr<\/a><br \/>\ncomme HTTPS et <code>localhost<\/code>.<\/p>\n<\/div>\n<h3 id=\"identify-trusted-types-violations\"><span class=\"ez-toc-section\" id=\"Identificar-infracciones-de-tipos-de-confianza\"><\/span>Identifier les violations de type de confiance <span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>D\u00e9sormais, chaque fois que Trusted Types d\u00e9tecte une violation, un rapport est envoy\u00e9 \u00e0 un <code>rapport-uri<\/code>. Par exemple, lorsque votre application transmet une cha\u00eene \u00e0 <code>innerHTML<\/code>, le navigateur envoie le rapport suivant:<\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-json\"><code class=\"language-json\"><span class=\"highlight-line\"><span class=\"token punctuation\">{<\/span><\/span><br><span class=\"highlight-line\"><span class=\"token property\">\"csp-report\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token punctuation\">{<\/span><\/span><br><span class=\"highlight-line\">    <span class=\"token property\">\"document-uri\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token string\">\"https:\/\/my.url.example\"<\/span><span class=\"token punctuation\">,<\/span><\/span><br><span class=\"highlight-line\">    <span class=\"token property\">\"violated-directive\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token string\">\"require-trusted-types-for\"<\/span><span class=\"token punctuation\">,<\/span><\/span><br><span class=\"highlight-line\">    <span class=\"token property\">\"disposition\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token string\">\"report\"<\/span><span class=\"token punctuation\">,<\/span><\/span><br><span class=\"highlight-line\">    <span class=\"token property\">\"blocked-uri\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token string\">\"trusted-types-sink\"<\/span><span class=\"token punctuation\">,<\/span><\/span><br><mark class=\"highlight-line highlight-line-active\">    <span class=\"token property\">\"line-number\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token number\">39<\/span><span class=\"token punctuation\">,<\/span><\/mark><br><span class=\"highlight-line\">    <span class=\"token property\">\"column-number\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token number\">12<\/span><span class=\"token punctuation\">,<\/span><\/span><br><mark class=\"highlight-line highlight-line-active\">    <span class=\"token property\">\"source-file\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token string\">\"https:\/\/my.url.example\/script.js\"<\/span><span class=\"token punctuation\">,<\/span><\/mark><br><span class=\"highlight-line\">    <span class=\"token property\">\"status-code\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">,<\/span><\/span><br><mark class=\"highlight-line highlight-line-active\">    <span class=\"token property\">\"script-sample\"<\/span><span class=\"token operator\">:<\/span> <span class=\"token string\">\"Element innerHTML &lt;img src=x\"<\/span><\/mark><br><span class=\"highlight-line\"><span class=\"token punctuation\">}<\/span><\/span><br><span class=\"highlight-line\"><span class=\"token punctuation\">}<\/span><\/span><\/code><\/pre>\n<p><\/web-copy-code><\/p>\n<p>Cela dit que dans <code>https:\/\/my.url.example\/script.js<\/code> en ligne 39 <code>innerHTML<\/code> a \u00e9t\u00e9 appel\u00e9 avec la cha\u00eene commen\u00e7ant par <code>&lt;img src=x<\/code>. Ces informations devraient vous aider \u00e0 d\u00e9terminer quelles parties de votre code peuvent introduire DOM XSS et devraient changer.<\/p>\n<div class=\"w-aside w-aside--note\">\n<p>La plupart des violations comme celle-ci peuvent \u00e9galement \u00eatre d\u00e9tect\u00e9es en ex\u00e9cutant un linter de code ou <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/github.com\/mozilla\/eslint-plugin-no-unsanitized\">v\u00e9rificateurs de code statiques<\/a><br \/>\ndans votre base de code. Cela permet d&#039;identifier rapidement un grand nombre de violations.<\/p>\n<p>Cela dit, vous devez \u00e9galement examiner les violations de CSP car elles sont d\u00e9clench\u00e9es lorsque du code non conforme s&#039;ex\u00e9cute.<\/p>\n<\/div>\n<h3 id=\"fix-the-violations\"><span class=\"ez-toc-section\" id=\"Arregle-las-infracciones\"><\/span>Corrigez les infractions <span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Il existe plusieurs options pour corriger une violation de type d&#039;approbation. Vous pouvez supprimer le code incrimin\u00e9, utiliser une biblioth\u00e8que, cr\u00e9er une strat\u00e9gie de type d&#039;approbation ou, en dernier recours, cr\u00e9er une strat\u00e9gie par d\u00e9faut.<\/p>\n<h4 id=\"rewrite-the-offending-code\"><span class=\"ez-toc-section\" id=\"Reescribe-el-codigo-ofensivo\"><\/span>R\u00e9\u00e9crire le code incrimin\u00e9 <span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Peut-\u00eatre que la fonctionnalit\u00e9 non conforme n&#039;est plus n\u00e9cessaire ou peut \u00eatre r\u00e9\u00e9crite de mani\u00e8re moderne sans utiliser les fonctions sujettes aux bogues?<\/p>\n<figure class=\"w-compare\">\n<p class=\"w-compare__label w-compare__label--worse\">\n<p>    Pas\n  <\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-javascript\"><code class=\"language-javascript\">il<span class=\"token punctuation\">.<\/span>innerHTML <span class=\"token operator\">=<\/span> <span class=\"token string\">'&lt;img src=xyz.jpg&gt;'<\/span><span class=\"token punctuation\">;<\/span><\/code><\/pre>\n<p><\/web-copy-code><\/figure>\n<figure class=\"w-compare\">\n<p class=\"w-compare__label w-compare__label--better\">\n<p>    Faire\n  <\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-javascript\"><code class=\"language-javascript\">il<span class=\"token punctuation\">.<\/span>textContent <span class=\"token operator\">=<\/span> <span class=\"token string\">''<\/span><span class=\"token punctuation\">;<\/span><br><span class=\"token keyword\">const<\/span> img <span class=\"token operator\">=<\/span> document<span class=\"token punctuation\">.<\/span><span class=\"token function\">createElement<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">'img'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br>img<span class=\"token punctuation\">.<\/span>src <span class=\"token operator\">=<\/span> <span class=\"token string\">'xyz.jpg'<\/span><span class=\"token punctuation\">;<\/span><br>il<span class=\"token punctuation\">.<\/span><span class=\"token function\">appendChild<\/span><span class=\"token punctuation\">(<\/span>img<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/code><\/pre>\n<p><\/web-copy-code><\/figure>\n<h4 id=\"use-a-library\"><span class=\"ez-toc-section\" id=\"Usa-una-biblioteca\"><\/span>Utiliser une biblioth\u00e8que <span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Certaines biblioth\u00e8ques g\u00e9n\u00e8rent d\u00e9j\u00e0 des types de confiance que vous pouvez transmettre aux fonctions du r\u00e9cepteur. Par exemple, vous pouvez utiliser<br \/>\n<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/github.com\/cure53\/DOMPurify\">DOMPurifier<\/a> pour nettoyer un extrait de code HTML, en supprimant les charges utiles XSS.<\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-javascript\"><code class=\"language-javascript\"><span class=\"token keyword\">importer<\/span> DOMPurifier <span class=\"token keyword\">desde<\/span> <span class=\"token string\">'dompurify'<\/span><span class=\"token punctuation\">;<\/span><br>il<span class=\"token punctuation\">.<\/span>innerHTML <span class=\"token operator\">=<\/span> DOMPurifier<span class=\"token punctuation\">.<\/span><span class=\"token function\">sanitize<\/span><span class=\"token punctuation\">(<\/span>html<span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token constant\">RETURN_TRUSTED_TYPE<\/span><span class=\"token operator\">:<\/span> <span class=\"token boolean\">vrai<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/code><\/pre>\n<p><\/web-copy-code><\/p>\n<p>DOMPurifier <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/github.com\/cure53\/DOMPurify#what-about-dompurify-and-trusted-types\">prend en charge les types de confiance<\/a> et il renverra du HTML nettoy\u00e9 envelopp\u00e9 dans un <code>TrustedHTML<\/code> objet afin que le navigateur ne g\u00e9n\u00e8re pas de violation.<\/p>\n<div class=\"w-aside w-aside--caution\">\n<p><strong>Mise en garde:<\/strong><br \/>\nSi la logique de nettoyage dans DOMPurify est bogu\u00e9e, votre application peut toujours avoir une vuln\u00e9rabilit\u00e9 DOM XSS. Les types de confiance vous obligent \u00e0 traiter une valeur <em>en quelque sorte<\/em>, mais ne d\u00e9finissez pas encore quelles sont les r\u00e8gles de traitement exactes et si elles sont s\u00e9curis\u00e9es.<\/p>\n<\/div>\n<h4 id=\"create-a-trusted-type-policy\"><span class=\"ez-toc-section\" id=\"Cree-una-politica-de-tipo-de-confianza\"><\/span>Cr\u00e9er une strat\u00e9gie de type d&#039;approbation <span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Parfois, il n&#039;est pas possible de supprimer la fonctionnalit\u00e9 et il n&#039;y a pas de biblioth\u00e8que pour nettoyer la valeur et cr\u00e9er un type de confiance pour vous. Dans ces cas, cr\u00e9ez vous-m\u00eame un objet Trusted Type.<\/p>\n<p>Pour cela, cr\u00e9ez d&#039;abord un <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/w3c.github.io\/webappsec-trusted-types\/dist\/spec\/#policies-hdr\">politique<\/a>. Les politiques sont des usines de types de confiance qui imposent certaines r\u00e8gles de s\u00e9curit\u00e9 \u00e0 leur entr\u00e9e:<\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-javascript\"><code class=\"language-javascript\"><span class=\"highlight-line\"><span class=\"token keyword\">si<\/span> <span class=\"token punctuation\">(<\/span>la fen\u00eatre<span class=\"token punctuation\">.<\/span>trustedTypes <span class=\"token operator\">&amp;&amp;<\/span> trustedTypes<span class=\"token punctuation\">.<\/span>createPolicy<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span> <\/span><br><span class=\"highlight-line\">  <span class=\"token keyword\">const<\/span> escapeHTMLPolicy <span class=\"token operator\">=<\/span> trustedTypes<span class=\"token punctuation\">.<\/span><span class=\"token function\">createPolicy<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">'myEscapePolicy'<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">{<\/span><\/span><br><mark class=\"highlight-line highlight-line-active\">    <span class=\"token function-variable function\">createHTML<\/span><span class=\"token operator\">:<\/span> <span class=\"token parameter\">string<\/span> <span class=\"token operator\">=&gt;<\/span> string<span class=\"token punctuation\">.<\/span><span class=\"token function\">replace<\/span><span class=\"token punctuation\">(<\/span><span class=\"token regex\">\/&lt;\/g<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">'&amp;lt;'<\/span><span class=\"token punctuation\">)<\/span><\/mark><br><span class=\"highlight-line\">  <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/span><br><span class=\"highlight-line\"><span class=\"token punctuation\">}<\/span><\/span><\/code><\/pre>\n<p><\/web-copy-code><\/p>\n<p>Ce code cr\u00e9e une strat\u00e9gie appel\u00e9e <code>myEscapePolicy<\/code> ce qui peut produire <code>TrustedHTML<\/code><br \/>\nobjets \u00e0 travers leur <code>createHTML ()<\/code> une fonction. Les r\u00e8gles d\u00e9finies \u00e9chapperont au HTML <code>&lt;<\/code> caract\u00e8res pour \u00e9viter de cr\u00e9er de nouveaux \u00e9l\u00e9ments HTML.<\/p>\n<p>Utilisez la politique comme ceci:<\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-javascript\"><code class=\"language-javascript\"><span class=\"token keyword\">const<\/span> escaped <span class=\"token operator\">=<\/span> escapeHTMLPolicy<span class=\"token punctuation\">.<\/span><span class=\"token function\">createHTML<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">'&lt;img src=x onerror=alert(1)&gt;'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br>console<span class=\"token punctuation\">.<\/span><span class=\"token function\">Journal<\/span><span class=\"token punctuation\">(<\/span>escaped <span class=\"token keyword\">instanceof<\/span> <span class=\"token class-name\">TrustedHTML<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>  <br>il<span class=\"token punctuation\">.<\/span>innerHTML <span class=\"token operator\">=<\/span> escaped<span class=\"token punctuation\">;<\/span>  <\/code><\/pre>\n<p><\/web-copy-code><\/p>\n<div class=\"w-aside w-aside--note\">\n<p>Alors que la fonction JavaScript est arriv\u00e9e \u00e0 <code>TrustedTypes.createPolicy ()<\/code> Quoi<br \/>\n<code>createHTML ()<\/code> renvoie une cha\u00eene, <code>createPolicy ()<\/code> renvoie un objet de strat\u00e9gie qui encapsule la valeur de retour dans un type correct, dans ce cas <code>TrustedHTML<\/code>.<\/p>\n<\/div>\n<h4 id=\"use-a-default-policy\"><span class=\"ez-toc-section\" id=\"Utilice-una-politica-predeterminada\"><\/span>Utiliser une politique par d\u00e9faut <span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Parfois, le code incrimin\u00e9 ne peut pas \u00eatre modifi\u00e9. Par exemple, c&#039;est le cas si vous chargez une biblioth\u00e8que tierce \u00e0 partir d&#039;un CDN. Dans ce cas, utilisez un<br \/>\n<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/w3c.github.io\/webappsec-trusted-types\/dist\/spec\/#default-policy-hdr\">politique par d\u00e9faut<\/a>:<\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-javascript\"><code class=\"language-javascript\"><span class=\"token keyword\">si<\/span> <span class=\"token punctuation\">(<\/span>la fen\u00eatre<span class=\"token punctuation\">.<\/span>trustedTypes <span class=\"token operator\">&amp;&amp;<\/span> trustedTypes<span class=\"token punctuation\">.<\/span>createPolicy<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span> <br>trustedTypes<span class=\"token punctuation\">.<\/span><span class=\"token function\">createPolicy<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">'default'<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">{<\/span><br><span class=\"token function-variable function\">createHTML<\/span><span class=\"token operator\">:<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token parameter\">string<span class=\"token punctuation\">,<\/span> sink<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">=&gt;<\/span> DOMPurifier<span class=\"token punctuation\">.<\/span><span class=\"token function\">sanitize<\/span><span class=\"token punctuation\">(<\/span>string<span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token constant\">RETURN_TRUSTED_TYPE<\/span><span class=\"token operator\">:<\/span> <span class=\"token boolean\">vrai<\/span><span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br><span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br><span class=\"token punctuation\">}<\/span><\/code><\/pre>\n<p><\/web-copy-code><\/p>\n<p>La politique avec nom <code>d\u00e9faut<\/code> il est utilis\u00e9 chaque fois qu&#039;une cha\u00eene est utilis\u00e9e dans un r\u00e9cepteur qui n&#039;accepte que le type de confiance.<\/p>\n<div class=\"w-aside w-aside--gotchas\">\n<strong>Gotchas!<\/strong> <\/p>\n<p>Utilisez la strat\u00e9gie par d\u00e9faut avec parcimonie et pr\u00e9f\u00e9rez refactoriser votre application pour utiliser \u00e0 la place des strat\u00e9gies r\u00e9guli\u00e8res. Cela encourage les conceptions o\u00f9 les r\u00e8gles de s\u00e9curit\u00e9 sont proches des donn\u00e9es qu&#039;elles traitent, o\u00f9 vous avez le plus de contexte pour nettoyer correctement la valeur.<\/p>\n<\/div>\n<h3 id=\"switch-to-enforcing-content-security-policy\"><span class=\"ez-toc-section\" id=\"Cambiar-para-hacer-cumplir-la-Politica-de-seguridad-del-contenido\"><\/span>Changement pour appliquer la politique de s\u00e9curit\u00e9 du contenu <span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Lorsque votre application ne viole plus, vous pouvez commencer \u00e0 appliquer les types d&#039;approbation:<\/p>\n<p><web-copy-code><\/p>\n<pre class=\"language-text\"><code class=\"language-text\">Content-Security-Policy: exigent-des-types-approuv\u00e9s-pour &#039;script&#039;; report-uri \/\/my-csp-endpoint.example<\/code><\/pre>\n<p><\/web-copy-code><\/p>\n<p>Voila! Maintenant, quelle que soit la complexit\u00e9 de votre application Web, la seule chose qui peut introduire une vuln\u00e9rabilit\u00e9 DOM XSS est le code dans l&#039;une de vos politiques, et vous pouvez la bloquer encore plus si <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/w3c.github.io\/webappsec-trusted-types\/dist\/spec\/#trusted-types-csp-directive\">limiter l&#039;\u00e9laboration des politiques<\/a>.<\/p>\n<h2 id=\"further-reading\"><span class=\"ez-toc-section\" id=\"Otras-lecturas\"><\/span>Autres lectures <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>    <web-feedback additional-questions=\"api\"><\/web-feedback>\n  <\/div>","protected":false},"excerpt":{"rendered":"<p>R\u00e9duisez la surface d&#039;attaque DOM XSS de votre application. 25 mars 2020 En vedette sur\u00a0: Safe &amp; Safe Pourquoi devriez-vous vous en soucier\u00a0? Le sc\u00e9nario de...<\/p>","protected":false},"author":1,"featured_media":83952,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1356],"tags":[],"class_list":["post-83951","post","type-post","status-publish","format-standard","has-post-thumbnail","category-dev"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v28.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Evite las vulnerabilidades de secuencias de comandos entre sitios basadas en DOM con los tipos de confianza - R Marketing Digital<\/title>\n<meta name=\"description\" content=\"Reduzca la superficie de ataque DOM XSS de su aplicaci\u00f3n. 25 de marzo de 2020 Aparece en: Seguro y a salvo \u00bfPor qu\u00e9 deber\u00eda preocuparte? La secuencia de\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rmarketingdigital.com\/fr\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Evite las vulnerabilidades de secuencias de comandos entre sitios basadas en DOM con los tipos de confianza\" \/>\n<meta property=\"og:description\" content=\"Reduzca la superficie de ataque DOM XSS de su aplicaci\u00f3n. 25 de marzo de 2020 Aparece en: Seguro y a salvo \u00bfPor qu\u00e9 deber\u00eda preocuparte? La secuencia de\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rmarketingdigital.com\/fr\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/\" \/>\n<meta property=\"og:site_name\" content=\"R Marketing Digital\" \/>\n<meta property=\"article:published_time\" content=\"2022-07-30T20:14:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/rmarketingdigital.com\/wp-content\/uploads\/2020\/09\/hero-1021770.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"360\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"R Marketing Digital\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/\"},\"author\":{\"name\":\"R Marketing Digital\",\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/#\\\/schema\\\/person\\\/7c0d9782b2977b840b3740f00c69a73e\"},\"headline\":\"Evite las vulnerabilidades de secuencias de comandos entre sitios basadas en DOM con los tipos de confianza\",\"datePublished\":\"2022-07-30T20:14:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/\"},\"wordCount\":1363,\"image\":{\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rmarketingdigital.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/hero-1021770.png\",\"articleSection\":[\"Dev\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/\",\"url\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/\",\"name\":\"Evite las vulnerabilidades de secuencias de comandos entre sitios basadas en DOM con los tipos de confianza - R Marketing Digital\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rmarketingdigital.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/hero-1021770.png\",\"datePublished\":\"2022-07-30T20:14:16+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/#\\\/schema\\\/person\\\/7c0d9782b2977b840b3740f00c69a73e\"},\"description\":\"Reduzca la superficie de ataque DOM XSS de su aplicaci\u00f3n. 25 de marzo de 2020 Aparece en: Seguro y a salvo \u00bfPor qu\u00e9 deber\u00eda preocuparte? La secuencia de\",\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/de\\\/dev\\\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\\\/#primaryimage\",\"url\":\"https:\\\/\\\/rmarketingdigital.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/hero-1021770.png\",\"contentUrl\":\"https:\\\/\\\/rmarketingdigital.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/hero-1021770.png\",\"width\":1200,\"height\":360,\"caption\":\"hero-1021770-2366845-png\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/#website\",\"url\":\"https:\\\/\\\/rmarketingdigital.com\\\/\",\"name\":\"R Marketing Digital\",\"description\":\"Agencia SEO | Publicidad redes sociales | Community Management\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/rmarketingdigital.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/rmarketingdigital.com\\\/#\\\/schema\\\/person\\\/7c0d9782b2977b840b3740f00c69a73e\",\"name\":\"R Marketing Digital\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c5599c203e0120b8ccbff4666af86f35f9b3dcad468a8bc6295313a3964a80be?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c5599c203e0120b8ccbff4666af86f35f9b3dcad468a8bc6295313a3964a80be?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c5599c203e0120b8ccbff4666af86f35f9b3dcad468a8bc6295313a3964a80be?s=96&d=mm&r=g\",\"caption\":\"R Marketing Digital\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u00c9vitez les vuln\u00e9rabilit\u00e9s de scripts intersites bas\u00e9s sur DOM avec des types de confiance - R Marketing Digital","description":"R\u00e9duisez la surface d&#039;attaque DOM XSS de votre application. 25 mars 2020 Appara\u00eet dans: S\u00fbr et s\u00e9curis\u00e9 Pourquoi devriez-vous vous en soucier? La s\u00e9quence de","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rmarketingdigital.com\/fr\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/","og_locale":"fr_FR","og_type":"article","og_title":"Evite las vulnerabilidades de secuencias de comandos entre sitios basadas en DOM con los tipos de confianza","og_description":"Reduzca la superficie de ataque DOM XSS de su aplicaci\u00f3n. 25 de marzo de 2020 Aparece en: Seguro y a salvo \u00bfPor qu\u00e9 deber\u00eda preocuparte? La secuencia de","og_url":"https:\/\/rmarketingdigital.com\/fr\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/","og_site_name":"R Marketing Digital","article_published_time":"2022-07-30T20:14:16+00:00","og_image":[{"width":1200,"height":360,"url":"https:\/\/rmarketingdigital.com\/wp-content\/uploads\/2020\/09\/hero-1021770.png","type":"image\/png"}],"author":"R Marketing Digital","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/#article","isPartOf":{"@id":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/"},"author":{"name":"R Marketing Digital","@id":"https:\/\/rmarketingdigital.com\/#\/schema\/person\/7c0d9782b2977b840b3740f00c69a73e"},"headline":"Evite las vulnerabilidades de secuencias de comandos entre sitios basadas en DOM con los tipos de confianza","datePublished":"2022-07-30T20:14:16+00:00","mainEntityOfPage":{"@id":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/"},"wordCount":1363,"image":{"@id":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/#primaryimage"},"thumbnailUrl":"https:\/\/rmarketingdigital.com\/wp-content\/uploads\/2020\/09\/hero-1021770.png","articleSection":["Dev"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/","url":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/","name":"\u00c9vitez les vuln\u00e9rabilit\u00e9s de scripts intersites bas\u00e9s sur DOM avec des types de confiance - R Marketing Digital","isPartOf":{"@id":"https:\/\/rmarketingdigital.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/#primaryimage"},"image":{"@id":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/#primaryimage"},"thumbnailUrl":"https:\/\/rmarketingdigital.com\/wp-content\/uploads\/2020\/09\/hero-1021770.png","datePublished":"2022-07-30T20:14:16+00:00","author":{"@id":"https:\/\/rmarketingdigital.com\/#\/schema\/person\/7c0d9782b2977b840b3740f00c69a73e"},"description":"R\u00e9duisez la surface d&#039;attaque DOM XSS de votre application. 25 mars 2020 Appara\u00eet dans: S\u00fbr et s\u00e9curis\u00e9 Pourquoi devriez-vous vous en soucier? La s\u00e9quence de","inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/rmarketingdigital.com\/de\/dev\/vermeiden-sie-dom-basierte-cross-site-scripting-schwachstellen-mit-vertrauenswurdigen-typen\/#primaryimage","url":"https:\/\/rmarketingdigital.com\/wp-content\/uploads\/2020\/09\/hero-1021770.png","contentUrl":"https:\/\/rmarketingdigital.com\/wp-content\/uploads\/2020\/09\/hero-1021770.png","width":1200,"height":360,"caption":"hero-1021770-2366845-png"},{"@type":"WebSite","@id":"https:\/\/rmarketingdigital.com\/#website","url":"https:\/\/rmarketingdigital.com\/","name":"Marketing num\u00e9rique","description":"Agence de r\u00e9f\u00e9rencement | Publicit\u00e9 sur les r\u00e9seaux sociaux | Gestion de communaut\u00e9","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rmarketingdigital.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Person","@id":"https:\/\/rmarketingdigital.com\/#\/schema\/person\/7c0d9782b2977b840b3740f00c69a73e","name":"Marketing num\u00e9rique","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/c5599c203e0120b8ccbff4666af86f35f9b3dcad468a8bc6295313a3964a80be?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c5599c203e0120b8ccbff4666af86f35f9b3dcad468a8bc6295313a3964a80be?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c5599c203e0120b8ccbff4666af86f35f9b3dcad468a8bc6295313a3964a80be?s=96&d=mm&r=g","caption":"R Marketing Digital"}}]}},"_links":{"self":[{"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/posts\/83951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/comments?post=83951"}],"version-history":[{"count":0,"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/posts\/83951\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/media\/83952"}],"wp:attachment":[{"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/media?parent=83951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/categories?post=83951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rmarketingdigital.com\/fr\/wp-json\/wp\/v2\/tags?post=83951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}