Upgrade to Pro — share decks privately, control downloads, hide ads and more …

不正クエリを検知するsqdを作った

Komei Nomura
February 12, 2019

 不正クエリを検知するsqdを作った

Komei Nomura

February 12, 2019
Tweet

More Decks by Komei Nomura

Other Decks in Technology

Transcript

  1. • sqd͸ɼϗϫΠτϦετϕʔεͰɼΫΤϦϩά͔Βෆਖ਼ΫΤϦΛݕ஌ 6 sqd TREIUUQTHJUIVCDPN,PNFJTRE 8FCΞϓϦέʔγϣϯͷ ΫΤϦϩά w ΫΤϦ" w

    ΫΤϦ# w ΫΤϦ$ TRE ϗϫΠτϦετ ΫΤϦΛϗϫΠτϦετͱর߹ ϗϫΠτϦετʹͳ͔ͬͨ ΫΤϦΛग़ྗ w ΫΤϦ" w ΫΤϦ# ΫΤϦ$
  2. 7 sqdʹΑΔෆਖ਼ΫΤϦݕ஌ $ cat whitelist SELECT * FROM users WHERE

    id = ? $ cat query.log | jq -r .query SELECT * FROM users WHERE id = 1 SELECT * FROM users WHERE id = 2 SELECT * FROM users DROP TABLE users ϗϫΠτϦετ ݕ஌ର৅ͷΫΤϦ܈ Ϧςϥϧ஋͸ϓϨʔεϗϧμʔʹ͢Δ $ cat query.log | jq -r .query | sqd -W whitelist SELECT * FROM users DROP TABLE users ݕ஌͞ΕͨΫΤϦ ϗϫΠτϦετϑΝΠϧΛࢦఆ ݕ஌ର৅ͷΫΤϦ܈Λೖྗ