Upgrade to Pro — share decks privately, control downloads, hide ads and more …

その正規表現、異議あり! 〜 ReDoSについて

その正規表現、異議あり! 〜 ReDoSについて

2019/04/24の銀座Rails#8での発表資料です。
スライド中で紹介している拙作gemはこちら https://github.com/expajp/reredos

Shu OGAWARA

April 24, 2019
Tweet

More Decks by Shu OGAWARA

Other Decks in Technology

Transcript

  1. ͦͷਖ਼نදݱɺҟٞ͋Γʂ
    ʙ ReDoSʹ͍ͭͯ
    Shu OGAWARA(@expajp)
    2019/04/24 ۜ࠲Rails #8

    View Slide

  2. ਖ਼نදݱ࢖ͬͯ·͔͢ʁ

    View Slide

  3. ϝΞυͷόϦσʔγϣϯʹ
    ਖ਼نදݱΛ࢖͍ͬͯΔਓ

    View Slide

  4. ͦΕ͸΋͔ͯ͜͠͠ΜͳͷͰ͸ʁ
    2019/04/24 4

    View Slide

  5. ໰୊ͳͦ͞͏
    2019/04/24 5

    View Slide

  6. ग़యɿχίχɾίϞϯζ
    http://commons.nicovideo.jp/material/nc38409

    View Slide

  7. ͜ͷਖ਼نදݱʹ͸ɺ
    ੬ऑੑ͕͋Δ

    View Slide

  8. ࣮ࡍʹ͝ཡ͍ͩ͘͞

    View Slide

  9. ςετεΫϦϓτ
    2019/04/24 9
    ग़యɿਖ਼نදݱͰͷϝʔϧΞυϨενΣοΫ͸ݟ௚͢΂͖ – ReDoS – yohgaki's blog
    https://blog.ohgaki.net/redos-must-review-mail-address-validation

    View Slide

  10. ࣮ߦ݁Ռ
    2019/04/24 10

    View Slide

  11. ݪҼ
    • ਖ਼نදݱΤϯδϯʹѱຐͷূ໌Λ΍Β͍ͤͯΔ
    • ʮ೚ҙ௕ͷจࣈྻʯදݱ͕ଓ͘ͱ
    ੾Ε໨͕Θ͔Βͳ͍ͷͰɺશύλʔϯΛௐ΂Δ
    – શύλʔϯΛௐ΂ͳ͍ͱ
    Ϛον͠ͳ͍͜ͱ͸֬ఆͰ͖ͳ͍
    – ૊Έ߹Θ͕ͤരൃ͍ͯ͠Δ
    2019/04/24 11

    View Slide

  12. ࣮ࡍʹ૊Έ߹Θ͕ͤ
    രൃ͍ͯ͠Δ༷ࢠΛ
    ͝ཡ͍ͩ͘͞

    View Slide

  13. ؆୯ͷͨΊ
    • ݟͤΔͷ͸͜ͷ෦෼ͷνΣοΫͷΈ
    2019/04/24 13

    View Slide

  14. ૊Έ߹Θͤരൃ
    • host. ·ͰϚονͯ͠ɺ࣍
    2019/04/24 14

    View Slide

  15. ૊Έ߹Θͤരൃ
    • . (υοτ) ·ͰϚον͕ͨ͠
    2019/04/24 15

    View Slide

  16. ૊Έ߹Θͤരൃ
    • ͦͷޙΖ͕ҧ͏ͷͰ໭Δ
    2019/04/24 16

    View Slide

  17. ૊Έ߹Θͤരൃ
    • ΍ͬͺΓҧ͏ͷͰ1ͭ໭ΔɺΛ܁Γฦ͠
    2019/04/24 17

    View Slide

  18. ૊Έ߹Θͤരൃ
    • ͜͜·Ͱ໭Δ
    2019/04/24 18

    View Slide

  19. ૊Έ߹Θͤരൃ
    • ࠷ޙ·Ͱ໭ͬͯ΋ɺ΍ͬͺΓϚον͠ͳ͍
    2019/04/24 19

    View Slide

  20. ૊Έ߹Θͤരൃ
    • * Λ0ճͱղऍͯ࣍͠Λௐ΂Δ
    2019/04/24 20

    View Slide

  21. ૊Έ߹Θͤരൃ
    • ΍ͬͺΓϚον͠ͳ͍ͷͰ1ͭͣͭޙΖʹ
    2019/04/24 21

    View Slide

  22. ૊Έ߹Θͤരൃ
    • 1ݸͣͭ໭ͬͯ΍ͬͱϚον͠ͳ͍ͷ͕֬ఆ
    2019/04/24 22

    View Slide

  23. ͜Ε͕ԿΛҙຯ͢Δ͔ʁ

    View Slide

  24. ԿΛҙຯ͢Δ͔
    • ௚લ·ͰҰகͯ͠ɺ
    ࠷ޙͷ1จࣈ͚ͩϚον͠ͳ͍จࣈྻΛ
    ϝʔϧΞυϨεཝʹ์ΓࠐΉ͚ͩͰ
    DoS߈ܸ͕Ͱ͖Δ
    2019/04/24 24

    View Slide

  25. DoS߈ܸ
    • Ϧιʔεʹҙਤతʹա৒ͳෛՙΛ͔͚ͨΓ
    ੬ऑੑΛ͍ͭͨΓ͢ΔࣄͰ
    αʔϏεΛ๦֐͢Δ߈ܸख๏ͷ͜ͱ
    – F5ΞλοΫͱ͔
    • ਖ਼نදݱΛ࢖ͬͨDoS͸ReDoSͱݺ͹ΕΔ
    2019/04/24 25

    View Slide

  26. ͞Βʹ൵͍͜͠ͱʹɺ
    ϝΞυͷ௕͞Ͱ஄͚ͳ͍

    View Slide

  27. ࣮ߦ݁Ռ
    2019/04/24 27

    View Slide

  28. ϝʔϧΞυϨεͷఆٛ
    • RFC1035, 5321ΑΓ
    – ϝʔϧΞυϨεશମ͸256จࣈҎ಺
    – Ϣʔβ໊ʢ@ͷલʣ͸64จࣈҎ಺
    – υϝΠϯ͸255จࣈҎ಺
    – υϝΠϯͷϥϕϧ͸63จࣈҎ಺
    • test.example.com – ଞɺ࢖͑Δจࣈ΋ܾ·͍ͬͯΔ
    2019/04/24 28

    View Slide

  29. Ͳ͏͢Ε͹Α͍ͷ͔ʁ

    View Slide

  30. จࣈྻΛ۠੾ͬͯ୹͘͠
    γϯϓϧͳਖ਼نදݱͰ൑ఆ

    View Slide

  31. ͱ͸͍͑ɺ
    ͍͍࣮ͪͪ૷͢Δͷ͸໘౗

    View Slide

  32. ͱ͍͏Θ͚Ͱ
    (FNΛ࡞Γ·ͨ͠

    View Slide

  33. reredos
    2019/04/24 33

    View Slide

  34. reredos
    • ReDoSʹڧ͍ϝΞυͷόϦσʔγϣϯΛߦ͍ɺ
    true/false Ͱฦ͢γϯϓϧͳgem
    • ࠓޙͷ༧ఆ
    – ଘࡏ͠ͳ͍TLDΛ஄͘
    – URLʹରԠ͢Δ
    • PR͓଴ͪͯ͠·͢
    2019/04/24 34

    View Slide

  35. ·ͱΊ
    • ਖ਼نදݱͰDoS߈ܸΛ͔͚Δख๏͕͋Δ
    – ReDoSͱ͍͏
    • ෳࡶͳਖ਼نදݱ͸ආ͚Δ΂͖
    – ࢓༷ΛͪΌΜͱಡΜͰɺ୹͍୯ҐͰνΣοΫΛ͢
    Δ͜ͱΛ৺͕͚Α͏
    • ϝΞυͰόϦσʔγϣϯ͔͚ΔgemΛ࡞ͬͨ
    2019/04/24 35

    View Slide

  36. ฏ੒͕ऴΘΔલʹରԠ͠Α͏

    View Slide

  37. ࣗݾ঺հ
    • Shu OGAWARA (@expajp )
    – ϦϯΧʔζגࣜձࣾ
    – Ruby/Railsྺ2೥ऑ
    – ग़਎͸ௗऔɺେֶ͸ਆށ
    – झຯ͸ΫϥγοΫܥͷ߹এ
    2019/04/24 37

    View Slide