Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
徳丸最終回
Search
mcz9mm
August 30, 2017
0
80
徳丸最終回
mcz9mm
August 30, 2017
Tweet
Share
More Decks by mcz9mm
See All by mcz9mm
SwiftUI-List-Pagination
mcz9mm
2
2.3k
ARKit2.0でAppleが伝えたいアプリ体験を考える
mcz9mm
2
1.1k
ゆるく学ぶARKit
mcz9mm
3
1.5k
What’s TCP/UDP?
mcz9mm
0
100
NATサーバーの必要性
mcz9mm
0
96
What’s New in ARKit2.0
mcz9mm
0
97
徳丸本 ログインフォーム
mcz9mm
0
100
arkit+animoji
mcz9mm
0
67
徳丸本8
mcz9mm
0
120
Featured
See All Featured
The Power of CSS Pseudo Elements
geoffreycrofte
76
5.8k
The World Runs on Bad Software
bkeepers
PRO
68
11k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
34
3k
Building a Modern Day E-commerce SEO Strategy
aleyda
40
7.3k
Raft: Consensus for Rubyists
vanstee
137
7k
10 Git Anti Patterns You Should be Aware of
lemiorhan
PRO
656
60k
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
357
30k
Producing Creativity
orderedlist
PRO
346
40k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
30
2.4k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.3k
Faster Mobile Websites
deanohume
307
31k
Rails Girls Zürich Keynote
gr2m
94
13k
Transcript
ϑΝΠϧμϯϩʔυʹΑΔXSS ಙؙձ
AJENDA ▸ ֓ཁ ▸ ख๏ͱӨڹ ▸ ݪҼ ▸ ରࡦ
֓ཁ μϯϩʔυʹΑΔJSͷ࣮ߦ Ξοϓϩʔυ ը૾ μϯϩʔυ
֓ཁ ը૾σʔλʹࠐΉ ▸ ΞοϓϩʔυΛ͢Δࡍͷը૾ɺpngjpgͱͯ͠ೝࣝ͢Δ͕ͣͩɺը૾σʔλͷ தʹHTMLλάؚ͕·Ε͍ͯΔͱ݅ʹΑͬͯHTMLϑΝΠϧͱͯ͠ೝࣝ͞Εͯ͠· ͏ ▸ ͜ͷ੬ऑੑΛར༻ͯ͠ɺѱҙͷ͋Δͷ͕ը૾σʔλʹHTMLJavaScriptΛࠐΜ ͰΞοϓϩʔυͯ͠߈ܸΛߦ͏
֓ཁ ରࡦ ▸ ϑΝΠϧͷContent-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ֦ுࢠͱը૾ͷத͕ରԠ͍ͯ͠Δ͜ͱΛ֬ೝ ▸ μϯϩʔυΛఆͨ͠ϑΝΠϧʹɺϨεϙϯεϔομͱ ͯ͠ʮContent-Disposition:attachmentʯΛࢦఆ͢Δ
߈ܸख๏ͱӨڹ ը૾ϑΝΠϧʹΑΔXSS ▸ IE8͔Βରࡦ͞Ε͍ͯΔ͕IE7Ҏલରࡦ͕ඞཁ Hoge.png <script>alert(‘XSS’);</script> ▸ IE8ςΩετͱͯ͠දࣔ͞Ε͍ͯΔ͕IE7ҎલͰ࣮ߦ͞Ε ͯ͠·͏
߈ܸख๏ͱӨڹ PDFμϯϩʔυը໘ʹΑΔXSS http://hoge.jp/fuga/nuge.php?file=614614891.pdf ▸ PDFʹPATHINFOͱݺΕΔݟ্͔͚ϑΝΠϧ໊ͷΑ͏ͳ ܗͰURLʹύϥϝʔλΛຒΊࠐΉ͜ͱ͕Ͱ͖Δ http://hoge.jp/fuga/nuge.php/a.html?file=614614891.pdf ▸ a.htmlଘࡏ͠ͳ͍ϑΝΠϧͳͷͰύϥϝʔλͱͯ͠εΫϦ ϓϓτʹ͞ΕΔ
ରࡦ ϑΝΠϧΞοϓϩʔυ࣌ͷରࡦ ▸ ֦ுࢠ͕ڐՄ͞Εͨͷ͔νΣοΫ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ϚδοΫόΠτͱɺϑΝΠϧࣝผͷͨΊʹϑΝΠϧͷઌ಄ ʹஔ͔Εͨݻఆͷจࣈྻͷ͜ͱ
ରࡦ ϚδοΫόΠτͷ֬ೝ array getimagesize(string $filename [, array &$imageinfo]) ▸ ฦΓ
1. 1: IMAGETYPE_GIF 2. 2: IMAGETYPE_JPEG 3. 3: IMAGETYPE_PNG
ରࡦ ϑΝΠϧμϯϩʔυ࣌ͷରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ
ରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ XSSͷ੬ऑੑContent-Typeͷؒҧ͍͕ݪҼ ▸ PDFܗࣜͷContent-TypeΛ[application/pdf]ͱઃఆ͢Δ͚ͩ Ͱ੬ऑੑͳ͘ͳΔ
ରࡦ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ ▸ μϯϩʔυͨ͠ϑΝΠϧΛΞϓϦέʔγϣϯͰར༻ͤͣɺ μϯϩʔυͰ͖͑͢͞Εྑ͍߹ɺʮContent- Disposition: attachmentʯͱ͍͏ϨεϙϯεϔομΛࢦఆ͢ Δ ▸
͜ͷ߹Content-Typeʮapplication/octet-streamʯʹ ͢ΔͱϑΝΠϧϔομ্ʮμϯϩʔυ͖͢ϑΝΠϧʯ ʹͳΔ
·ͱΊ ͷجຊ ▸ Content-Typeͱ֦ுࢠΛਖ਼͘͠ઃఆ͢Δ͜ͱ
Ҏ্