[{"data":1,"prerenderedAt":460},["ShallowReactive",2],{"content-ja-\u002Fsyntax\u002Fpaths-and-security":3},{"id":4,"title":5,"body":6,"description":452,"extension":453,"meta":454,"navigation":455,"path":456,"seo":457,"stem":458,"__hash__":459},"content_ja\u002Fsyntax\u002Fpaths-and-security.md","パスとセキュリティ",{"type":7,"value":8,"toc":437},"minimark",[9,12,27,32,43,48,71,75,90,94,106,110,123,127,138,179,183,190,214,217,280,284,321,328,331,352,355,406,409,433],[10,11,5],"h1",{"id":5},[13,14,15,19,20,19,23,26],"p",{},[16,17,18],"code",{},"include","、",[16,21,22],{},"component",[16,24,25],{},"extend"," のパス解決と、利用時のセキュリティ注意点です。",[28,29,31],"h2",{"id":30},"doc_root",".doc_root",[13,33,34,35,39,40,42],{},"プロジェクトのルートを示す ",[36,37,38],"strong",{},"マーカーファイル"," ",[16,41,31],{}," があります。中身は空で構いません（中身は評価しません）。",[44,45,47],"h3",{"id":46},"doc_root-がある場合",".doc_root がある場合",[49,50,51,61],"ul",{},[52,53,54,55],"li",{},"読み込みは原則 ",[36,56,57,60],{},[16,58,59],{},"rootDir"," 配下に限る",[52,62,63,66,67,70],{},[36,64,65],{},"ルート相対パス","（",[16,68,69],{},"\u002Fcomponents\u002Fcard.md"," など）が使える",[44,72,74],{"id":73},"doc_root-がない場合",".doc_root がない場合",[49,76,77,83],{},[52,78,79,80],{},"ルート相対パスは ",[36,81,82],{},"エラー",[52,84,85,86,89],{},"相対パスは有効（",[16,87,88],{},"..\u002F"," による上方向への移動は制限しない）",[28,91,93],{"id":92},"絶対パスとシンボリックリンクnode","絶対パスとシンボリックリンク（Node）",[49,95,96,103],{},[52,97,98,99,102],{},"絶対パスは、正規化後の実体が ",[36,100,101],{},"rootDir 内に収まるときだけ","許可",[52,104,105],{},"シンボリックリンクは追従するが、解決後の実体が rootDir 内のときだけ許可",[28,107,109],{"id":108},"ブラウザcsr","ブラウザ（CSR）",[49,111,112,118],{},[52,113,114,115],{},"ライブラリは fetch しない。",[36,116,117],{},"loader 必須",[52,119,120],{},[36,121,122],{},"クロスオリジンはサポートしない",[28,124,126],{"id":125},"リモート-urlnode","リモート URL（Node）",[13,128,129,130,133,134,137],{},"Node 環境では ",[16,131,132],{},"https:\u002F\u002F..."," などのリモート URL を ",[36,135,136],{},"include と component の両方","で許可します。",[139,140,145],"pre",{"className":141,"code":142,"language":143,"meta":144,"style":144},"language-markdown shiki shiki-themes github-light github-dark","\u003C!--\n@hg\ninclude https:\u002F\u002Fexample.com\u002Fsnippets\u002Ffooter.md\n@endhg\n-->\n","markdown","",[16,146,147,155,161,167,173],{"__ignoreMap":144},[148,149,152],"span",{"class":150,"line":151},"line",1,[148,153,154],{},"\u003C!--\n",[148,156,158],{"class":150,"line":157},2,[148,159,160],{},"@hg\n",[148,162,164],{"class":150,"line":163},3,[148,165,166],{},"include https:\u002F\u002Fexample.com\u002Fsnippets\u002Ffooter.md\n",[148,168,170],{"class":150,"line":169},4,[148,171,172],{},"@endhg\n",[148,174,176],{"class":150,"line":175},5,[148,177,178],{},"-->\n",[28,180,182],{"id":181},"_-プレフィックスpartial","_ プレフィックス（partial）",[13,184,185,186,189],{},"Sass の ",[16,187,188],{},"_"," partial と同様:",[49,191,192,203,211],{},[52,193,194,196,197,199,200],{},[16,195,188],{}," で始まるファイル、および ",[16,198,188],{}," で始まるディレクトリ配下は ",[36,201,202],{},"SSG \u002F SSR のエントリ対象外",[52,204,205,207,208,210],{},[16,206,18],{}," \u002F ",[16,209,22],{}," による読み込み自体は可能",[52,212,213],{},"glob で明示的に指定したパスは、除外を上書きしてエントリに含められる",[28,215,216],{"id":216},"式のセキュリティ",[218,219,220,233],"table",{},[221,222,223],"thead",{},[224,225,226,230],"tr",{},[227,228,229],"th",{},"項目",[227,231,232],{},"方針",[234,235,236,248,267],"tbody",{},[224,237,238,242],{},[239,240,241],"td",{},"式の範囲",[239,243,244,247],{},[16,245,246],{},"{{ }}"," は式のみ。任意の JS 評価はしない",[224,249,250,253],{},[239,251,252],{},"危険キー",[239,254,255,207,258,207,261,207,264],{},[16,256,257],{},"__proto__",[16,259,260],{},"prototype",[16,262,263],{},"constructor",[16,265,266],{},"__defineGetter__",[224,268,269,272],{},[239,270,271],{},"危険キーアクセス",[239,273,274,66,276,279],{},[36,275,82],{},[16,277,278],{},"forbidden_property_access","）",[28,281,283],{"id":282},"出力と-xss","出力と XSS",[218,285,286,294],{},[221,287,288],{},[224,289,290,292],{},[227,291,229],{},[227,293,232],{},[234,295,296,305,313],{},[224,297,298,302],{},[239,299,300],{},[16,301,246],{},[239,303,304],{},"エスケープしない（生埋め込み）",[224,306,307,310],{},[239,308,309],{},"ユーザー入力",[239,311,312],{},"サニタイズしない",[224,314,315,318],{},[239,316,317],{},"責任分界",[239,319,320],{},"MD→HTML 後の XSS は後段・呼び出し側",[13,322,323,324,327],{},"危険そうな context 値には ",[16,325,326],{},"suspicious_context_value"," 警告が出ますが、値は改変しません。",[28,329,330],{"id":330},"秘密情報",[49,332,333,346,349],{},[52,334,335,336,341,342,345],{},"サーバー専用データは ",[36,337,338],{},[16,339,340],{},"serverContext"," で渡し、",[16,343,344],{},"renderClient"," では渡さない",[52,347,348],{},"front matter に秘密を書かない（運用上の推奨）",[52,350,351],{},"front matter はデフォルトで出力から除去される",[28,353,354],{"id":354},"資源制限",[218,356,357,366],{},[221,358,359],{},[224,360,361,363],{},[227,362,229],{},[227,364,365],{},"制限",[234,367,368,376,390,398],{},[224,369,370,373],{},[239,371,372],{},"循環 include \u002F component \u002F extend",[239,374,375],{},"検出 → スキップ + 警告",[224,377,378,387],{},[239,379,380,207,383,386],{},[16,381,382],{},"if",[16,384,385],{},"each"," 構造ネスト",[239,388,389],{},"合計最大 20",[224,391,392,395],{},[239,393,394],{},"front matter ソース",[239,396,397],{},"最大 64 KB",[224,399,400,403],{},[239,401,402],{},"props \u002F API context",[239,404,405],{},"無制限",[28,407,408],{"id":408},"関連",[49,410,411,418,424],{},[52,412,413],{},[414,415,417],"a",{"href":416},"\u002Fja\u002Fapi\u002Floader","loader",[52,419,420],{},[414,421,423],{"href":422},"\u002Fja\u002Fapi\u002Ferror-codes","エラーコード",[52,425,426,430,431],{},[414,427,429],{"href":428},"\u002Fja\u002Fapi\u002Frender-server","renderServer"," — ",[16,432,340],{},[434,435,436],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":144,"searchDepth":157,"depth":157,"links":438},[439,443,444,445,446,447,448,449,450,451],{"id":30,"depth":157,"text":31,"children":440},[441,442],{"id":46,"depth":163,"text":47},{"id":73,"depth":163,"text":74},{"id":92,"depth":157,"text":93},{"id":108,"depth":157,"text":109},{"id":125,"depth":157,"text":126},{"id":181,"depth":157,"text":182},{"id":216,"depth":157,"text":216},{"id":282,"depth":157,"text":283},{"id":330,"depth":157,"text":330},{"id":354,"depth":157,"text":354},{"id":408,"depth":157,"text":408},"パス解決、_ partial、セキュリティ上の注意点","md",{},true,"\u002Fsyntax\u002Fpaths-and-security",{"title":5,"description":452},"syntax\u002Fpaths-and-security","9-PpE_1-pr9sXPevcJHhIMwWhT9NdKwF6ohE1-GrZ-Q",1787223115027]