その正規表現、異議あり！ 〜 ReDoSについて

2019/04/24の銀座Rails#8での発表資料です。
スライド中で紹介している拙作gemはこちら https://github.com/expajp/reredos

Transcript

1. ͦͷਖ਼نදݱɺҟٞ͋Γʂ
   ʙ ReDoSʹ͍ͭͯ
   Shu OGAWARA(@expajp)
   2019/04/24 ۜ࠲Rails #8
   

   View Slide

2. ਖ਼نදݱ࢖ͬͯ·͔͢ʁ
   

   View Slide

3. ϝΞυͷόϦσʔγϣϯʹ
   ਖ਼نදݱΛ࢖͍ͬͯΔਓ
   

   View Slide

4. ͦΕ͸΋͔ͯ͜͠͠ΜͳͷͰ͸ʁ
   2019/04/24 4
   

   View Slide

5. ໰୊ͳͦ͞͏
   2019/04/24 5
   

   View Slide

6. ग़యɿχίχɾίϞϯζ
   http://commons.nicovideo.jp/material/nc38409
   

   View Slide

7. ͜ͷਖ਼نදݱʹ͸ɺ
   ੬ऑੑ͕͋Δ
   

   View Slide

8. ࣮ࡍʹ͝ཡ͍ͩ͘͞
   

   View Slide

9. ςετεΫϦϓτ
   2019/04/24 9
   ग़యɿਖ਼نදݱͰͷϝʔϧΞυϨενΣοΫ͸ݟ௚͢΂͖ – ReDoS – yohgaki's blog
   https://blog.ohgaki.net/redos-must-review-mail-address-validation
   

   View Slide

10. ࣮ߦ݁Ռ
    2019/04/24 10
    

    View Slide

11. ݪҼ
    • ਖ਼نදݱΤϯδϯʹѱຐͷূ໌Λ΍Β͍ͤͯΔ
    • ʮ೚ҙ௕ͷจࣈྻʯදݱ͕ଓ͘ͱ
    ੾Ε໨͕Θ͔Βͳ͍ͷͰɺશύλʔϯΛௐ΂Δ
    – શύλʔϯΛௐ΂ͳ͍ͱ
    Ϛον͠ͳ͍͜ͱ͸֬ఆͰ͖ͳ͍
    – ૊Έ߹Θ͕ͤരൃ͍ͯ͠Δ
    2019/04/24 11
    

    View Slide

12. ࣮ࡍʹ૊Έ߹Θ͕ͤ
    രൃ͍ͯ͠Δ༷ࢠΛ
    ͝ཡ͍ͩ͘͞
    

    View Slide

13. ؆୯ͷͨΊ
    • ݟͤΔͷ͸͜ͷ෦෼ͷνΣοΫͷΈ
    2019/04/24 13
    

    View Slide

14. ૊Έ߹Θͤരൃ
    • host. ·ͰϚονͯ͠ɺ࣍
    2019/04/24 14
    

    View Slide

15. ૊Έ߹Θͤരൃ
    • . (υοτ) ·ͰϚον͕ͨ͠
    2019/04/24 15
    

    View Slide

16. ૊Έ߹Θͤരൃ
    • ͦͷޙΖ͕ҧ͏ͷͰ໭Δ
    2019/04/24 16
    

    View Slide

17. ૊Έ߹Θͤരൃ
    • ΍ͬͺΓҧ͏ͷͰ1ͭ໭ΔɺΛ܁Γฦ͠
    2019/04/24 17
    

    View Slide

18. ૊Έ߹Θͤരൃ
    • ͜͜·Ͱ໭Δ
    2019/04/24 18
    

    View Slide

19. ૊Έ߹Θͤരൃ
    • ࠷ޙ·Ͱ໭ͬͯ΋ɺ΍ͬͺΓϚον͠ͳ͍
    2019/04/24 19
    

    View Slide

20. ૊Έ߹Θͤരൃ
    • * Λ0ճͱղऍͯ࣍͠Λௐ΂Δ
    2019/04/24 20
    

    View Slide

21. ૊Έ߹Θͤരൃ
    • ΍ͬͺΓϚον͠ͳ͍ͷͰ1ͭͣͭޙΖʹ
    2019/04/24 21
    

    View Slide

22. ૊Έ߹Θͤരൃ
    • 1ݸͣͭ໭ͬͯ΍ͬͱϚον͠ͳ͍ͷ͕֬ఆ
    2019/04/24 22
    

    View Slide

23. ͜Ε͕ԿΛҙຯ͢Δ͔ʁ
    

    View Slide

24. ԿΛҙຯ͢Δ͔
    • ௚લ·ͰҰகͯ͠ɺ
    ࠷ޙͷ1จࣈ͚ͩϚον͠ͳ͍จࣈྻΛ
    ϝʔϧΞυϨεཝʹ์ΓࠐΉ͚ͩͰ
    DoS߈ܸ͕Ͱ͖Δ
    2019/04/24 24
    

    View Slide

25. DoS߈ܸ
    • Ϧιʔεʹҙਤతʹա৒ͳෛՙΛ͔͚ͨΓ
    ੬ऑੑΛ͍ͭͨΓ͢ΔࣄͰ
    αʔϏεΛ๦֐͢Δ߈ܸख๏ͷ͜ͱ
    – F5ΞλοΫͱ͔
    • ਖ਼نදݱΛ࢖ͬͨDoS͸ReDoSͱݺ͹ΕΔ
    2019/04/24 25
    

    View Slide

26. ͞Βʹ൵͍͜͠ͱʹɺ
    ϝΞυͷ௕͞Ͱ஄͚ͳ͍
    

    View Slide

27. ࣮ߦ݁Ռ
    2019/04/24 27
    

    View Slide

28. ϝʔϧΞυϨεͷఆٛ
    • RFC1035, 5321ΑΓ
    – ϝʔϧΞυϨεશମ͸256จࣈҎ಺
    – Ϣʔβ໊ʢ@ͷલʣ͸64จࣈҎ಺
    – υϝΠϯ͸255จࣈҎ಺
    – υϝΠϯͷϥϕϧ͸63จࣈҎ಺
    • test.example.com – ଞɺ࢖͑Δจࣈ΋ܾ·͍ͬͯΔ
    2019/04/24 28
    

    View Slide

29. Ͳ͏͢Ε͹Α͍ͷ͔ʁ
    

    View Slide

30. จࣈྻΛ۠੾ͬͯ୹͘͠
    γϯϓϧͳਖ਼نදݱͰ൑ఆ
    

    View Slide

31. ͱ͸͍͑ɺ
    ͍͍࣮ͪͪ૷͢Δͷ͸໘౗
    

    View Slide

32. ͱ͍͏Θ͚Ͱ
    (FNΛ࡞Γ·ͨ͠
    

    View Slide

33. reredos
    2019/04/24 33
    

    View Slide

34. reredos
    • ReDoSʹڧ͍ϝΞυͷόϦσʔγϣϯΛߦ͍ɺ
    true/false Ͱฦ͢γϯϓϧͳgem
    • ࠓޙͷ༧ఆ
    – ଘࡏ͠ͳ͍TLDΛ஄͘
    – URLʹରԠ͢Δ
    • PR͓଴ͪͯ͠·͢
    2019/04/24 34
    

    View Slide

35. ·ͱΊ
    • ਖ਼نදݱͰDoS߈ܸΛ͔͚Δख๏͕͋Δ
    – ReDoSͱ͍͏
    • ෳࡶͳਖ਼نදݱ͸ආ͚Δ΂͖
    – ࢓༷ΛͪΌΜͱಡΜͰɺ୹͍୯ҐͰνΣοΫΛ͢
    Δ͜ͱΛ৺͕͚Α͏
    • ϝΞυͰόϦσʔγϣϯ͔͚ΔgemΛ࡞ͬͨ
    2019/04/24 35
    

    View Slide

36. ฏ੒͕ऴΘΔલʹରԠ͠Α͏
    

    View Slide

37. ࣗݾ঺հ
    • Shu OGAWARA (@expajp )
    – ϦϯΧʔζגࣜձࣾ
    – Ruby/Railsྺ2೥ऑ
    – ग़਎͸ௗऔɺେֶ͸ਆށ
    – झຯ͸ΫϥγοΫܥͷ߹এ
    2019/04/24 37
    

    View Slide