Upgrade to Pro — share decks privately, control downloads, hide ads and more …

今だからこそ振り返る register_globals / PHPerKaigi 2020

今だからこそ振り返る register_globals / PHPerKaigi 2020

Wataru MIYAGUNI

February 11, 2020
Tweet

More Decks by Wataru MIYAGUNI

Other Decks in Programming

Transcript

  1. ࠓ͔ͩΒͦ͜ৼΓฦΔ
    register_globals
    1)1FS,BJHJ
    5VF
    ٶᅳ౉@gongoZ

    View Slide

  2. @gongoZ
    github.com/gongo
    SmartHR, Inc.
    ࣗݾ঺հ

    View Slide

  3. ͋ΒΏΔ΋ͷΛ&NBDTͰ࠶ݱ͢Δͷ͕झຯͰ͢
    w "/&4&NVMBUPSXSJUUFOJO&NBDT-JTQ
    w ϑΝϛίϯΤϛϡϨʔλʔ
    w IUUQTHJUIVCDPNHPOHPFNBDTOFT
    w *NQMFNFOU+7.CZ&NBDT
    w
    &NBDT͕+7.ʹͳΔ
    w IUUQTHJUIVCDPNHPOHPFNBDTKWN
    ࣗݾ঺հ (Con’t)

    View Slide

  4. SFHJTUFS@HMPCBMTͱ͸Կͳͷ͔
    SFHJTUFS@HMPCBMTͷੜ֔Λ௥ͬͯΈͨ
    SFHJTUFS@HMPCBMTແ͖ੈΛͲ͏ੜ͖Δ͔
    ΞδΣϯμ

    View Slide

  5. SFHJTUFS@HMPCBMTͱ͸

    View Slide

  6. 1)1ʙʹଘࡏ͍ͯͨ͠QIQJOJσΟϨΫςΟϒ
    register_globals ͱ͸?
    https://www.php.net/manual/ja/ini.core.php#ini.register-globals

    View Slide

  7. register_globalsಈ࡞ྫ
    SFHJTUFS@HMPCBMT0⒎

    View Slide

  8. register_globalsಈ࡞ྫ
    SFHJTUFS@HMPCBMT0O

    View Slide

  9. register_globalsಈ࡞ྫ
    ϑΥʔϜͷ໊લ͕
    ͦͷ··ม਺໊ʹ

    View Slide

  10. register_globals ͷޭ੷
    https://www.youtube.com/watch?v=wCZ5TJCBWMg&t=1339
    QIQ%BZͷΩʔϊʔτl:FBSTPG1)1zͰ
    3BTNVT͕SFHJTUFS@HMPCBMTʹ͍ͭͯݴٴ
    ʮSFHJTUFS@HMPCBMT͕ແ͚Ε͹

    ɹɹࠓͷ1)1ͷൃల͸ແ͔ͬͨʯ
    ʮಈతͳ8FCϖʔδͷߏஙʹ׳Ε͍ͯͳ͍
    ɹɹϢʔβ͕ଟ͍࣌୅ɺϑΥʔϜ໊ͦͷ··ͷ
    ɹɹม਺ΛࢀরͰ͖Δͷ͸ըظతͩͬͨʯ

    View Slide

  11. 1)1ϚχϡΞϧηΩϡϦςΟάϩʔόϧม਺ͷొ࿥ػೳͷ࢖༻๏
    ޫ͕͋Ε͹ҋ΋͋Δ
    https://www.php.net/manual/ja/security.globals.php

    View Slide

  12. ҆શͰͳ͍ίʔυྫ
    SFHJTUFS@HMPCBMT0⒎
    https://www.php.net/manual/ja/security.globals.php

    View Slide

  13. ҆શͰͳ͍ίʔυྫ
    https://www.php.net/manual/ja/security.globals.php
    SFHJTUFS@HMPCBMT0O

    View Slide

  14. PHP ʹؔ͢Δ༗໊ͳݴ༿
    (WebArchive) IPA ηΩϡΞϓϩάϥϛϯάߨ࠲ ୈ1ষ ΑΓྑ͍WebΞϓϦέʔγϣϯઃܭͷώϯτ

    View Slide

  15. w ✨͍͢͝ػೳ
    w ྑ͘΋ѱ͘΋1)1Λൃలཱͤͨ͞໾ऀ
    ·ͱΊ
    register_globals ͱ͸?
    ཱ໾ऀͷҰੜΛ
    ௥͍͔͚ͯΈ͍ͨʂʂ

    View Slide

  16. register_globals ͷҰੜ

    View Slide



  17. register_globalsͷҰੜ

    View Slide



  18. C


    w SFHJTUFS@HMPCBMT͕࣮૷
    w ͜ͷ࣌͸·ͩHQD@HMPCBMTͱ͍͏໊લͩͬͨ
    w (&5 1045 $00,*&͚ͩΛର৅
    w ͦΕҎ֎ 4&44*0/ͱ͔
    ΋ѻ͏͜ͱʹͳͬͨ
    ͷͰ1)1CFUBͰϦωʔϜ
    https://github.com/php/php-src/commit/ab16816e
    PHP 4.0 beta 3

    View Slide


  19. ʙ PHP 4.0.6


    ʙ೥લ൒
    w ηΩϡϦςΟʹؔ͢Δ໰͍߹Θ͕ͤࡴ౸
    ʮSFHJTUFS@HMPCBMT͕શ෦ѱ͍ةݥʯ
    ʮ໰୊ʹͳ͍ͬͯΔίʔυ͸

    ɹɹม਺ͷॳظԽ࿙ΕͳͲ؆୯ͳ΋ͷ΋͋Γɺ

    ɹɹ͜ͷઃఆΛແ͚ͩ͘͢Ͱ͸ղܾ͠ͳ͍ʯ
    w
    ͦͷޙ΋͍Ζ͍Ζ͋Γɻɻ
    ϝʔϦϯάϦετͷ౤ߘ
    3BTNVT

    View Slide


  20. ʙ PHP 4.0.6 (Con’t)



    https://marc.info/?l=php-internals&m=99638397319055&w=2
    w 1)1Ҏ߱ͷ1SPQPTBMΛ3BTNVT͕
    ։ൃऀϝʔϦϯάϦετʹ౤ߘ ҎԼɺཁ໿

    ɹʮσϑΥϧτ͸P⒎ʹ͠·͠ΐ͏ʯ
    ɹʮ(&5΍1045ʹରͯ͠ ҆શ͸౰વͱͯ͠

    ɹɹɹखܰʹΞΫηεͰ͖Δ࢓૊Έ͸࢒͓͖͍ͯͨ͠ʯ

    View Slide


  21. ʙ PHP 4.0.6 (Con’t)



    https://marc.info/?l=php-internals&m=99638397319055&w=2
    w ✍1)1Ҏ߱ͷ1SPQPTBMΛ3BTNVT͕
    ։ൃऀϝʔϦϯάϦετʹ౤ߘ
    ͜ΜͳจষͰ࢝·͍ͬͯ·ͨ͠
    5IFCFTUUIJOHBCPVU1)1JTUIBUJUIBTTVDIB
    TIBMMPXMFBSOJOHDVSWFUIBUOPOQSPHSBNNFST
    DBOXSJUFXFCBQQT
    5IFXPSTUUIJOHBCPVU1)1JTUIBUJUIBTTVDI
    BTIBMMPXMFBSOJOHDVSWFUIBUOPO
    QSPHSBNNFSTXSJUFXFCBQQT
    WJB1SPQPTBMͷ๯಄

    View Slide





  22. PHP 4.1.0
    w ⚙εʔύʔάϩʔόϧม਺͕࣮૷
    w @(&5΍@1045ͳͲ
    w ैདྷͷ)551@YYY@7"34ͱҧ͍ɺHMPCBMએݴͤͣʹ͢
    ͙࢖͑ͯखܰ
    w ⚙JNQPSU@SFRVFTU@WBSJBCMFT
    ͕࣮૷
    w SFHJTUFS@HMPCBMTͷػೳΛͪΐͬͱ҆શʹͨ͠ܗͰ࠶ݱ
    ͢Δؔ਺
    https://www.php.net/releases/4_1_0.php

    View Slide





  23. PHP 4.1.0
    w ⚙εʔύʔάϩʔόϧม਺͕࣮૷
    w @(&5΍@1045ͳͲ
    w ैདྷͷ)551@YYY@7"34ͱҧ͍ɺHMPCBMએݴͤͣʹ͢
    ͙࢖͑ͯखܰ
    w ⚙JNQPSU@SFRVFTU@WBSJBCMFT
    ͕࣮૷
    w SFHJTUFS@HMPCBMTͷػೳΛͪΐͬͱ҆શʹͨ͠ܗͰ࠶ݱ
    ͢Δؔ਺
    https://www.php.net/releases/4_1_0.php
    JNQPSU@SFRVFTU@WBSJBCMFT
    ͷྫ
    https://www.php.net/manual/en/function.import-request-variables

    View Slide







  24. PHP 4.2.0
    w ⚙SFHJTUFS@HMPCBMT͕σϑΥϧτͰ0''ʹ
    https://www.php.net/releases/4_2_0.php

    View Slide







  25. PHP 5.3.0
    w ⚙SFHJTUFS@HMPCBMT͕%FQSFDBUFEʹ
    https://www.php.net/releases/5_3_0.php

    View Slide







  26. PHP 5.4.0
    w (PPECZFSFHJTUFS@HMPCBMT
    w Ұॹʹফ͑ͨػೳ
    w NBHJD@RVPUFT
    w TBGF@NPEF
    https://www.php.net/releases/5_4_0.php

    View Slide



  27. register_globals ͸ҰੜΛऴ͕͑ͨ…

    C




    View Slide



  28. register_globals ͸ҰੜΛऴ͕͑ͨ…
    Y ʜ

    SFHJTUFS@HMPCBMT͕࢖ΘΕ͍ͯͨ
    ΞϓϦͷਓੜ͸ଓ͘ʂʂ

    View Slide

  29. register_globals ͷͳ͍
    ੈքͰੜ͖͍ͯͨ͘Ίʹ

    View Slide

  30. SFHJTUFS@HMPCBMTґଘΛແ͘͠ɺ৽͍͠ਓੜΛ࢝ΊΔ
    w ਖ਼߈๏
    Կ΋͠ͳ͍ 1)1·ͰͷΞοϓσʔτʹཹΊΔ

    w SFHJTUFS@HMPCBMTҎ֎ͷ੬ऑੑʹ΋ରԠͰ͖ͳ͍
    SFHJTUFS@HMPCBMTΛ࠶ݱ͢ΔίʔυΛॻ͍ͯɺ1)1ͷόʔ
    δϣϯΛ্͛Δ
    w ⚔मཏͷಓ
    register_globals Λ࢖͍ͬͯͨ
    ΞϓϦ͸Ͳ͏ੜ͖࢒Ε͹͍͍͔?
    ͬͪ͜ͷ࿩Λ͠·͢

    View Slide

  31. php.net Ͱௐ΂ͯΈ·ͨ͠
    https://www.php.net/manual/en/faq.misc.php
    )PXEP*EFBMXJUIregister_globals

    View Slide

  32. ͜ͷख๏͸ؒҧ͍ͬͯ·͢
    Կ͕ؒҧ͍ͬͯΔͷ͔ɺͲ͏͢Ε͹໰୊ͳ͍࠶ݱ
    ίʔυͳͷ͔Λ
    w SFHJTUFS@HMPCBMTॳڃฤ
    w SFHJTUFS@HMPCBMTதڃฤ
    w SFHJTUFS@HMPCBMT্ڃฤ
    Ͱݟ͍͖ͯ·͠ΐ͏

    View Slide

  33. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷
    w ରԠ
    தڃฤ
    w ࢓༷
    w ରԠ
    ্ڃฤ
    w ࢓༷
    w ରԠ

    View Slide

  34. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠ
    தڃฤ
    w ࢓༷
    w ରԠ
    ্ڃฤ
    w ࢓༷
    w ରԠ

    View Slide

  35. άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    ͲͬͪʹͳΔ

    View Slide

  36. άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    ඇਪ঑ͷσΟϨΫςΟϒSFHJTUFS@HMPCBMT͕
    POʹͳ͍ͬͯΔͱɺWBSJBCMFT@PSEFSͷઃ
    ఆ͸ɺ&/7ɺ(&5ɺ1045ɺ$00,*&͓Α
    ͼ4&37&3ͷ֤ม਺͕άϩʔόϧείʔϓ
    ʹऔΓࠐ·ΕΔॱ൪΋ࠨӈ͠·͢ɻ
    https://www.php.net/manual/ja/ini.core.php#ini.variables-order
    WBSJBCMFT@PSEFSΛߟྀ͢Δඞཁ͕͋Δ

    View Slide

  37. άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    ඇਪ঑ͷσΟϨΫςΟϒSFHJTUFS@HMPCBMT͕
    POʹͳ͍ͬͯΔͱɺWBSJBCMFT@PSEFSͷઃ
    ఆ͸ɺ&/7ɺ(&5ɺ1045ɺ$00,*&͓Α
    ͼ4&37&3ͷ֤ม਺͕άϩʔόϧείʔϓ
    ʹऔΓࠐ·ΕΔॱ൪΋ࠨӈ͠·͢ɻ
    https://www.php.net/manual/ja/ini.core.php#ini.variables-order
    WBSJBCMFT@PSEFSΛߟྀ͢Δඞཁ͕͋Δ
    WBSJBCMFT@PSEFSͷྫ

    View Slide

  38. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷
    w ରԠ
    ্ڃฤ
    w ࢓༷
    w ରԠ

    View Slide

  39. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠ
    ্ڃฤ
    w ࢓༷
    w ରԠ

    View Slide

  40. @4&44*0/ͱregister_globalsͷؔ܎

    View Slide

  41. @4&44*0/ͱSFHJTUFS@HMPCBMTͷؔ܎

    View Slide

  42. ηογϣϯม਺ͷΈࢀর౉͠
    https://gongo.hatenablog.com/entry/2014/12/24/132841
    w @(&5΍@1045ͳͲͱಉ͘͡ѻͬͯ͸ବ໨
    w ͜͏͍͏ΠϝʔδͰ

    View Slide

  43. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏
    ্ڃฤ
    w ࢓༷
    w ରԠ

    View Slide

  44. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏
    ্ڃฤ
    w ࢓༷@'*-&4ʹ͸ཁ஫ҙ
    w ରԠ

    View Slide

  45. @'*-&4ͷ͓͞Β͍

    View Slide

  46. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520

    View Slide

  47. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520

    View Slide

  48. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520

    View Slide

  49. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520

    View Slide

  50. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520

    View Slide

  51. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    ͔ͦͬͪʙ
    https://gongo.hatenablog.com/entry/2014/10/02/211520

    View Slide

  52. ༨ஊ
    https://www.php.net/manual/ja/function.extract.php
    SFHJTUFS@HMPCBMT͕POͷঢ়ଶͰ@'*-&4ʹ
    ରͯ͠FYUSBDU
    Λ࣮ߦͯ͠&953@4,*1Λ
    ࢦఆ͢Δͱɺͦͷ݁Ռʹڻ͘͜ͱͰ͠ΐ͏ɻ
    FYUSBDU
    ͷϔϧϓʹॻ͔Ε͍ͯͨϝϞ

    View Slide

  53. ༨ஊ
    https://www.php.net/manual/ja/function.extract.php
    SFHJTUFS@HMPCBMT͕POͷঢ়ଶͰ@'*-&4ʹ
    ରͯ͠FYUSBDU
    Λ࣮ߦͯ͠&953@4,*1Λ
    ࢦఆ͢Δͱɺͦͷ݁Ռʹڻ͘͜ͱͰ͠ΐ͏ɻ
    FYUSBDU
    ͷϔϧϓʹॻ͔Ε͍ͯͨϝϞ
    ڻ͍ͨʙ

    View Slide

  54. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏
    ্ڃฤ
    w ࢓༷@'*-&4ʹ͸ཁ஫ҙ
    w ରԠ͕Μ͹Ζ

    View Slide

  55. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏
    ্ڃฤ
    w ࢓༷@'*-&4ʹ͸ཁ஫ҙ
    w ରԠ͕Μ͹Ζ
    w ͜Εશͯߟྀ͢Δͷେม
    w ΋͔ͨ͠͠Βଞʹ΋͋Δͷ͔ͳ
    w ࣗྗͰରԠ͢Δͷ͸΋͏ແཧͳΜ͡Ό
    ͦΜͳ͋ͳͨʹ
    ͪΐͬͱͨ͠࿕ใ͕

    View Slide

  56. HPOHPNFSDJGVMQPMMVUFS
    w 1)1Ҏ্ͰSFHJTUFS@HMPCBMTΛ࠶ݱ͢Δ
    ϥΠϒϥϦ
    w ೥݄ݱࡏɺ1)1·Ͱಈ࡞֬ೝ
    w ͓·͚ͰNBHJD@RVPUFT@HQDʹ΋ରԠ
    w ௚༁͢Δͱ࣊൵ਂ͍Ԛછ
    w ͋͘·Ͱ΋ܨ͗ͱͯ͠ߟ͑Δ΂͖
    w 1)1όʔδϣϯΞοϓΛ࠷༏ઌʹʂ
    https://github.com/gongo/merciful-polluter

    View Slide

  57. ·ͱΊ

    View Slide

  58. w SFHJTUFS@HMPCBMTͬͯ΍ͬͺ͍͢͝ʂ
    w ͍ΖΜͳҙຯͰ
    w SFHJTUFS@HMPCBMT͕ᐫͱͳ͍ͬͯͯ1)1
    ΞοϓσʔτͰ͖ͳ͍ਓɺఘΊͳ͍Ͱʂ
    w Ͳ͏ʹ͔ͳΓ·͢
    ·ͱΊ

    View Slide

  59. w 1)1ϚχϡΞϧ
    w IUUQTXXXQIQOFUNBOVBMKBJOEFYQIQ
    w 1)1ιʔείʔυ

    w IUUQTHJUIVCDPNQIQQIQTSDUSFFQIQ
    w 1)1։ൃऀϝʔϦϯάϦετ "SDIJWF

    w IUUQTNBSDJOGP MQIQJOUFSOBMT
    ࢀߟจݙ

    View Slide