Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
徳丸最終回
Search
mcz9mm
August 30, 2017
0
74
徳丸最終回
mcz9mm
August 30, 2017
Tweet
Share
More Decks by mcz9mm
See All by mcz9mm
SwiftUI-List-Pagination
mcz9mm
2
2.1k
ARKit2.0でAppleが伝えたいアプリ体験を考える
mcz9mm
2
1k
ゆるく学ぶARKit
mcz9mm
3
1.4k
What’s TCP/UDP?
mcz9mm
0
98
NATサーバーの必要性
mcz9mm
0
84
What’s New in ARKit2.0
mcz9mm
0
81
徳丸本 ログインフォーム
mcz9mm
0
97
arkit+animoji
mcz9mm
0
64
徳丸本8
mcz9mm
0
110
Featured
See All Featured
How to train your dragon (web standard)
notwaldorf
88
5.7k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
26
1.5k
Typedesign – Prime Four
hannesfritz
40
2.4k
Optimising Largest Contentful Paint
csswizardry
33
3k
A designer walks into a library…
pauljervisheath
204
24k
The World Runs on Bad Software
bkeepers
PRO
65
11k
Thoughts on Productivity
jonyablonski
67
4.4k
Building a Scalable Design System with Sketch
lauravandoore
460
33k
Learning to Love Humans: Emotional Interface Design
aarron
273
40k
For a Future-Friendly Web
brad_frost
175
9.4k
Java REST API Framework Comparison - PWX 2021
mraible
28
8.3k
Unsuck your backbone
ammeep
669
57k
Transcript
ϑΝΠϧμϯϩʔυʹΑΔXSS ಙؙձ
AJENDA ▸ ֓ཁ ▸ ख๏ͱӨڹ ▸ ݪҼ ▸ ରࡦ
֓ཁ μϯϩʔυʹΑΔJSͷ࣮ߦ Ξοϓϩʔυ ը૾ μϯϩʔυ
֓ཁ ը૾σʔλʹࠐΉ ▸ ΞοϓϩʔυΛ͢Δࡍͷը૾ɺpngjpgͱͯ͠ೝࣝ͢Δ͕ͣͩɺը૾σʔλͷ தʹHTMLλάؚ͕·Ε͍ͯΔͱ݅ʹΑͬͯHTMLϑΝΠϧͱͯ͠ೝࣝ͞Εͯ͠· ͏ ▸ ͜ͷ੬ऑੑΛར༻ͯ͠ɺѱҙͷ͋Δͷ͕ը૾σʔλʹHTMLJavaScriptΛࠐΜ ͰΞοϓϩʔυͯ͠߈ܸΛߦ͏
֓ཁ ରࡦ ▸ ϑΝΠϧͷContent-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ֦ுࢠͱը૾ͷத͕ରԠ͍ͯ͠Δ͜ͱΛ֬ೝ ▸ μϯϩʔυΛఆͨ͠ϑΝΠϧʹɺϨεϙϯεϔομͱ ͯ͠ʮContent-Disposition:attachmentʯΛࢦఆ͢Δ
߈ܸख๏ͱӨڹ ը૾ϑΝΠϧʹΑΔXSS ▸ IE8͔Βରࡦ͞Ε͍ͯΔ͕IE7Ҏલରࡦ͕ඞཁ Hoge.png <script>alert(‘XSS’);</script> ▸ IE8ςΩετͱͯ͠දࣔ͞Ε͍ͯΔ͕IE7ҎલͰ࣮ߦ͞Ε ͯ͠·͏
߈ܸख๏ͱӨڹ PDFμϯϩʔυը໘ʹΑΔXSS http://hoge.jp/fuga/nuge.php?file=614614891.pdf ▸ PDFʹPATHINFOͱݺΕΔݟ্͔͚ϑΝΠϧ໊ͷΑ͏ͳ ܗͰURLʹύϥϝʔλΛຒΊࠐΉ͜ͱ͕Ͱ͖Δ http://hoge.jp/fuga/nuge.php/a.html?file=614614891.pdf ▸ a.htmlଘࡏ͠ͳ͍ϑΝΠϧͳͷͰύϥϝʔλͱͯ͠εΫϦ ϓϓτʹ͞ΕΔ
ରࡦ ϑΝΠϧΞοϓϩʔυ࣌ͷରࡦ ▸ ֦ுࢠ͕ڐՄ͞Εͨͷ͔νΣοΫ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ϚδοΫόΠτͱɺϑΝΠϧࣝผͷͨΊʹϑΝΠϧͷઌ಄ ʹஔ͔Εͨݻఆͷจࣈྻͷ͜ͱ
ରࡦ ϚδοΫόΠτͷ֬ೝ array getimagesize(string $filename [, array &$imageinfo]) ▸ ฦΓ
1. 1: IMAGETYPE_GIF 2. 2: IMAGETYPE_JPEG 3. 3: IMAGETYPE_PNG
ରࡦ ϑΝΠϧμϯϩʔυ࣌ͷରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ
ରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ XSSͷ੬ऑੑContent-Typeͷؒҧ͍͕ݪҼ ▸ PDFܗࣜͷContent-TypeΛ[application/pdf]ͱઃఆ͢Δ͚ͩ Ͱ੬ऑੑͳ͘ͳΔ
ରࡦ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ ▸ μϯϩʔυͨ͠ϑΝΠϧΛΞϓϦέʔγϣϯͰར༻ͤͣɺ μϯϩʔυͰ͖͑͢͞Εྑ͍߹ɺʮContent- Disposition: attachmentʯͱ͍͏ϨεϙϯεϔομΛࢦఆ͢ Δ ▸
͜ͷ߹Content-Typeʮapplication/octet-streamʯʹ ͢ΔͱϑΝΠϧϔομ্ʮμϯϩʔυ͖͢ϑΝΠϧʯ ʹͳΔ
·ͱΊ ͷجຊ ▸ Content-Typeͱ֦ுࢠΛਖ਼͘͠ઃఆ͢Δ͜ͱ
Ҏ্