正規表現とセキュリティ / Regular Expressions and Their Security-Related Aspects

B ਖ਼نදݱͱηΩϡϦςΟ !͓஡ͷਫঁࢠେֶ 5BLBTIJ:POFVDIJ !MNU@TXBMMPX !ZOVDIZ Ұൠࣾஂ๏ਓηΩϡϦςΟɾΩϟϯϓڠٞձߨࢣҭ੒(ɾاը( ?

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ 5BLBTIJ:POFVDIJ ‣ !MNU@TXBMMPX !ZOVDIZ ‣ ॴଐ ‣
'MBUU4FDVSJUZ *OD ‣ ౦ژେֶཧֶ෦৘ใՊֶՊ ‣ ଞͷ׆ಈ ‣ DUGCMFBEFS ‣ TFDDBNQڠٞձߨࢣҭ੒(اը( ‣ XFCTFDKQ ‣ 4FFIUUQTTIJGUKTJOGP

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ࠓ೔͍ͨ͜͠ͱ ਖ਼نදݱͱηΩϡϦςΟ ‣ ʮֶ෦ͰֶΜͰ͍ΔܭࢉػՊֶ෼໺ͷ஌ࣝ͸ɺͲΜͳͱ͜ΖͰ໾ཱ ͭΜͩΖ͏ʁʯͱ͍͏ૉ๿ͳٙ໰ʹ͍ͭͯɺηΩϡϦςΟٕज़ͷ؍ ఺͔Βߟ͑ͯΈΔɻ ‣ ࢀߟ͓͜͜஡ͷਫঁࢠେֶͰͷؔ࿈Պ໨
‣ σʔλߏ଄ͱΞϧΰϦζϜ ೥ ‣ ݴޠཧ࿦ͱΦʔτϚτϯ ɾ೥બ୒ ‣ ܗࣜݴޠ࿦ ɾ೥બ୒ ‣ ਖ਼نදݱͦΕͦͷ΋ͷͱɺਖ਼نදݱʹؔ͢ΔηΩϡϦςΟత؍఺ Λɺ࣮༻ͱཧ࿦ͷ྆໘͔Β੔ཧֶͯ͠Ϳɻ ‣ ηΩϡϦςΟɾΩϟϯϓͷએ఻ ओ໨త ɻ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ࠓ೔࿩͢͜ͱ ਖ਼نදݱͱηΩϡϦςΟ ‣ ೖ໳ɾਖ਼نදݱ ‣ ਖ਼نදݱͱ͸Կ͔Λ੔ཧ͠·͢ɻ ‣ ਖ਼نදݱͷཧ࿦ͱ࣮૷
‣ ਖ਼نදݱΛࢧ͑Δཧ࿦ͷ֓؍ΛோΊͯɺ͔ͦ͜Βਖ਼نදݱΤϯδϯͷ ۪௚ͳ࣮૷ํ਑ʹ͍ͭͯٞ࿦͠·͢ɻ ‣ ਖ਼نදݱͱ੬ऑੑ ‣ ਖ਼نදݱΤϯδϯͷ۪௚ͳ࣮૷ํ਑͔Βࣗવʹ༠ಋ͞ΕΔ߈ܸख๏ʹ ͍ͭͯΛઆ໌͠·͢ɻ ‣ ஫ҙҰ෦ܗࣜతͳఆٛΛ࣋ͪग़ͯ͠આ໌͢Δ͕ɺޡΓؚ͕·ΕΔՄ ೳੑ͸े෼ʹ͋ΔͷͰɺద੾ͳڭՊॻΛࢀর͢Δ͜ͱɻ

ೖ໳ɾਖ਼نදݱ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ʮจࣈྻݕࡧͬͯେมʜʯ ೖ໳ɾਖ਼نදݱ ‣ ໰୊࣍ͷΑ͏ͳೖྗ͔Β࣍ͷΑ͏ͳग़ྗΛಘ͍ͨɻ ‣ ೖྗ௕͍จࣈྻ ‣ ग़ྗೖྗதͷBCDͱEFGͰғ·Εͨ෦෼
ෳ਺͋Δ৔߹͸ෳ਺ ‣ ղ౴ྫ۪௚ͳํ਑ ‣ จࣈྻΛॱ൪ʹᢞΊ͍ͯ͘ɻͦͯ͠BCDΛΈ͚ͭ࣍ୈɺ͔ͦ͜ΒEFG͕ొ৔ ͢Δ·ͰΛه࿥͢Δɻ ‣ ۪௚ͳํ਑ͷࠔΓ͝ͱ ‣ গ͠Ͱ΋໰୊͕มΘΔͱίʔυΛେ͖͘มߋ͠ͳͯ͘͸͍͚ͳ͍ɻ ‣ ͨͩʮ΍Δ͚ͩʯͷ࣮૷Ͱ͋ͬͯ΋ɺ࣮૷͸΍΍໘౗ɻ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱΛར༻͢Δ ೖ໳ɾਖ਼نදݱ ‣ ਖ਼نදݱΛར༻͢Δͱɺઌड़ͷΑ͏ͳจࣈྻݕࡧ͸௚ͪʹߦ͑Δɻ ‣ ਖ਼نදݱه߸ྻͷू߹ ݴޠ ΛͭͷจࣈྻͰද͢ํ๏ɻ
‣ ར఺ ‣ ਖ਼نදݱҎ֎ͷ෦෼ͷίʔυΛ࠶ར༻͠΍͍͢ɻ ‣ จࣈྻͷݕࡧɾஔ׵ͷͨΊʹඞཁͳίʔυྔ͸ൺֱతখ͘͞ͳΔɻ import re s = 'abchogedef' print(re.match(r'abc(.*?)def', s).groups()) 1ZUIPO ਖ਼نදݱ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱͷجຊతͳߏจ ུ֓ ೖ໳ɾਖ਼نදݱ ‣ <> ׅ֯ހ ͦͷ಺ଆʹॻ͔Εͨจࣈͷ͏ͪͲΕ͔จࣈ
‣ ྫBCDE<> BCDEʹ͔Β·Ͱͷ਺ࣈ͕ଓ͍͍ͯΔΑ͏ͳจࣈྻ ‣ υοτ ΄΅શͯͷจࣈछͷ͏ͪͲΕ͔จࣈ ‣ ྫBCE BCͱEͷؒʹͳΜΒ͔ͷจࣈ͕ڬ·Ε͍ͯΔΑ͏ͳจࣈྻ ‣ ΞελϦεΫ ͦͷ௚લͷਖ਼نදݱͷճҎ্ͷ܁Γฦ͠ ‣ ྫB BͷճҎ্ͷ܁Γฦ͠

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱͷ׆༻ࣄྫ ೖ໳ɾਖ਼نදݱ ‣ ্هͷ1ZUIPOεΫϦϓτ͸εϖʔεͰ۠੾ΒΕͨͭͷจࣈྻͷ ॱংΛೖΕସ͑Δ FH+PIO'PPˠ'PP
+PIO ɻ ‣ ΩϟϓνϟɾࢀরΛۦ࢖͢Δͱɺඇৗʹศརߴ౓ͳςΩετૢ࡞͕ ୹͍ίʔυྔͰߦ͑Δɻ import re s = """John Foo John Bar John Foobar """ print(re.sub(r'^(.*) (.*)$', '\\2, \\1', s, flags=re.MULTILINE)) 1ZUIPOεΫϦϓτͷྫ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱͷ׆༻ࣄྫ ೖ໳ɾਖ਼نදݱ ‣ HSFQͰ΋ਖ਼نදݱΛར༻Ͱ͖Δɻ ‣ &ΦϓγϣϯΛར༻
‣ ্ड़ͷίϚϯυྫ͸ɺ͋ΔϑΝΠϧIPHFͷதͰɺ<>ʹ Ϛον͢ΔจࣈྻΛؚΉߦͷΈΛग़ྗ͢Δɻ cat hoge | grep -E "03/2[1-9]" HSFQ ਖ਼نදݱ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱͷ׆༻ࣄྫ ೖ໳ɾਖ਼نදݱ ‣ ҰൠతͳΤσΟλ FH FNBDT
WJN 7JTVBM 4UVEJP$PEF ʹ͸ਖ਼نද ݱʹΑΔςΩετૢ࡞ػೳ ͕͍͍ͭͯΔɻ ‣ εΫϦʔϯγϣοτͰ͸ɺ 7JTVBM4UVEJP$PEFͰ੨ ۭจݿͰ഑෍͞Ε͍ͯΔ ʰޗഐ͸ೣͰ͋ΔʱͷϧϏ ෦෼Λਖ਼نදݱͰϋΠϥΠ τ͍ͯ͠Δɻ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱͷߏจ ೖ໳ɾਖ਼نදݱ ‣ ͍͔ͭ͘ͷߏจ͕͋Δɻ ‣ ྫ104*9Ͱఆٛ͞Ε͍ͯΔ΋ͷ ‣ 43&
4JNQMF3FHVMBS&YQSFTTJPO ‣ #3& #BTJD3FHVMBS&YQSFTTJPO ‣ &3& &YUFOEFE3FHVMBS&YQSFTTJPO ‣ ྫ1FSM͕࠾༻͍ͯ͠Δ΋ͷ ‣ ΄΅+BWB 1ZUIPO 3VCZ౳ʹ૊Έࠐ·Ε͍ͯΔΤϯδϯ΍1$3& 1FSM$PNQBUJCMF3FHVMBS&YQSFTTJPOT ͱಉ౳ ‣ Ұ෦͸ܗࣜతͳਖ਼نදݱͷఆٛ ޙड़ ͔Βҳ୤ͨ͠ه๏Λ࣋ͭɻ

ਖ਼نදݱͷཧ࿦ͱ࣮૷

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ جຊతͳޠ۟ͱه๏ͷఆٛ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ ޠ ͋Δ͍͸ه߸ྻ ۭͰͳ͍จࣈू߹ ͷཁૉΛॏෳΛڐͯ͠༗
ݶݸ ݸҎ্ ฒ΂ͨྻͷ͜ͱɻ ‣ ۭޠ௕͞ͷه߸ྻͷ͜ͱͰ͋Γɺ͜ΕΛ ͱॻ͖ද͢ɻ ‣ ݴޠ ্ͷه߸ྻશମ͔ΒͳΔू߹ ͷ෦෼ू߹ɻ ‣ ࿈઀ه߸ྻ ʹ͍ͭͯɺ ͷ͋ͱʹ Λଓ͚ͯฒ΂ͨه߸ྻΛ ͱ ͷ࿈઀ͱݺͼɺ͜ΕΛ ͱॻ͖ද͢ɻ Σ ϵ Σ* Σ x, y x y x y xy

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نݴޠͷఆٛ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ ه߸ू߹ ্ͷਖ਼نݴޠ ਖ਼ଇݴޠ ͷू߹ͷ࠶ؼతఆٛ ‣
ۭͷݴޠ ͸ਖ਼نݴޠͰ͋Δɻ ‣ ۭޠͷΈ͔ΒͳΔݴޠ\ ^͸ਖ਼نݴޠͰ͋Δɻ ‣ தͷ೚ҙͷݩ ʹ͍ͭͯɺ୯߲ू߹\ ^͸ਖ਼نݴޠͰ͋Δɻ ‣ ͱ ͕ਖ਼نݴޠͰ͋Δ࣌ɺ ͸ਖ਼نݴޠͰ͋Δɻ ‣ ʜ ͱ ͷ࿨ू߹ ‣ ʜ ͳ͓ ‣ ʜ ‣ ͦΕҎ֎ͷ ্ͷݴޠ͸ਖ਼نݴޠͰ͸ͳ͍ɻ Σ ∅ ϵ Σ c c A B A ∪ B AB A* A ∪ B A B AB {ab|a ∈ A, b ∈ B} An = AAAA . . . . A A0 = {ϵ} A* ∪n {An |0 ≤ n} Σ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱͷܗࣜతఆٛ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ ه߸ू߹ ্ͷਖ਼نදݱ ͱͦΕ͕ද͢ू߹ ͷ࠶ؼతఆٛ ‣
͸ਖ਼نදݱͰ͋Γɺ͔ͭ Ͱ͋Δɻ ‣ தͷ೚ҙͷݩ ͸ਖ਼نදݱͰ͋Γɺ͔ͭ Ͱ͋Δɻ ‣ ͕ਖ਼نදݱͰ͋Δͱ͖ɺҎԼ͕੒Γཱͭɻ ‣ ͸ਖ਼نදݱͰɺ Ͱ͋Δɻ ‣ ͸ਖ਼نදݱͰɺ Ͱ͋Δɻ ‣ ͸ਖ਼نදݱͰɺ Ͱ͋Δɻ ‣ ͸ਖ਼نදݱͰɺ Ͱ͋Δɻ ‣ ͜ΕΒͷنଇʹΑΓಋग़͞ΕΔه߸ྻͷΈ͕ਖ਼نදݱͰ͋Δɻ Σ e L(e) ∅ ϵ L(∅) = ∅, L(ϵ) = {ϵ} Σ c L(c) = {c} e1 , e2 (e1 ) L((e1 )) = L(e1 ) e1 |e2 L(e1 |e2 ) = L(e1 ) ∪ L(e2 ) e1 e2 L(e1 e2 ) = L(e1 )L(e2 ) e* 1 L(e* 1 ) = (L(e1 ))*

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ༗ݶΦʔτϚτϯ ུ֓ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ ඇܾఆੑ༗ݶΦʔτϚτϯ /POEFUFSNJOJTUJD'JOJUF"VUPNBUPO/'"
‣ ঢ়ଶू߹ จࣈू߹ ભҠؔ܎ ։࢝ঢ়ଶ डཧঢ়ଶू߹ ͷͭͷ૊ɻ ‣ ભҠؔ܎ͷఆٛͷ Λ ͱͨ͠΋ͷΛ /'"ͱݺͿɻ ‣ ܾఆੑ༗ݶΦʔτϚτϯ %FUFSNJOJTUJD'JOJUF"VUPNBUPO%'" ‣ ͕੒Γཱͭ/'"ͷ͜ͱɻ ͜ͷͱ͖ભҠؔ܎͸ભҠؔ਺ͱ΋ݺ͹ΕΔɻ Q Σ δ ⊆ Q × Σ × Q q0 ∈ Q F ⊆ Q Σ Σ ∪ {ϵ} ϵ ∀q ∈ Q . ∀c ∈ Σ . |{q′ |(q, c, q′ ) ∈ δ}| = 1

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ભҠͱडཧ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ ඇܾఆੑ ༗ݶΦʔτϚτϯ ʹ͍ͭͯͷఆٛ ‣
ભҠͭ૊ ΛભҠͱݺͿɻ ‣ डཧ͢Δͭͷ༻๏ ‣ ه߸ྻ ʹ͍ͭͯɺ ͕ଘࡏ͠ɺ ͔ͭ ͕੒Γཱͭͱ͖ɺ ͸ ه߸ྻ Λडཧ͢Δͱ͍͏ɻ ‣ ͱఆٛͨ࣌͠ʹɺ Λ ͷडཧ ݴޠͱݺͼɺ͋Δݴޠ ʹ͍ͭͯ Ͱ͋Δ͜ͱΛ ͕ Λडཧ ͢Δɺͱ͍͏ɻ M = (Q, Σ, δ, q0 , F) (p, a, q) ∈ δ w = c1 c2 . . . cn q1 , q2 , . . . , qn ∈ Q (q0 , c1 , q1 ), (q1 , c2 , q2 ), . . . , (qn−1 , cn , qn ) ∈ δ qn ∈ F M w L(M) = {w ∈ Σ*|M͸wΛडཧ͢Δ} L(M) M L L = L(M) M L

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱͱ༗ݶΦʔτϚτϯ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ ࣮͸ਖ਼نදݱͱ༗ݶΦʔτϚτϯʹ͸ਂ͍ؔΘΓ͕͋Δɻ ‣ ਖ਼نݴޠ㲗 /'"͍͔ͳΔਖ਼نݴޠʹ͍ͭͯ΋ɺͦΕΛडཧ͢Δ
/'"͕ଘࡏ͢Δɻٯʹ͍͔ͳΔ /'"ʹ͍ͭͯ΋ɺͦͷडཧݴ ޠ͸ਖ਼نݴޠͰ͋Δɻ ‣ /'"㲗%'"͍͔ͳΔ/'"ʹ͍ͭͯ΋ɺͦΕͱडཧݴޠ͕Ұக͢Δ %'"͕ଘࡏ͢Δ ώϯτঢ়ଶू߹Λͦͷ΂͖ू߹ʹஔ׵ ɻٯʹ͍͔ͳ Δ%'"ʹ͍ͭͯ΋ɺͦΕͱडཧݴޠ͕౳͍͠/'"͕ଘࡏ͢Δɻ ‣ /'"㲗 /'"͜ΕΒ΋/'"㲗%'"ಉ༷ʹม׵Մೳɻ ‣ ͭ·Γɺ͔ͳΓࡶʹදݱ͢ΔͱɺҎԼ͕੒ཱ͢Δɻ ‣ ਖ਼نදݱͷදݱೳྗ /'"ͷදݱೳྗ %'"ͷදݱೳྗ ϵ ϵ ϵ ϵ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱͱ /'"ͷରԠͷྫ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ϵ a.*b B͔Β࢝·ΓCͰऴΘΔจࣈྻ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ਖ਼نදݱΤϯδϯ΁ͷԠ༻ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ ઌͷࣄ࣮͔Βɺਖ਼نදݱΤϯδϯͷ۪௚ͳ࣮૷ํ਑͕ಘΒΕΔɻ ‣ ೖྗਖ਼نදݱͱݕࡧର৅ͷจࣈྻͷͭɻ ‣ ग़ྗਖ਼نදݱʹจࣈྻ͕Ϛον͔ͨ͠Ͳ͏͔ɻ
‣ ΞϧΰϦζϜ ‣ ਖ਼نදݱΛҰ౓/'"ʹม׵͢Δɻ ‣ ݕࡧର৅ͷจࣈྻΛೖྗͱͯ͠/'"্ͷঢ়ଶભҠΛߦ͏ɻ ‣ ભҠޠͷ࠷ऴঢ়ଶ͕डཧঢ়ଶͰ͋Ε͹ʮϚονͨ͠ʯͱग़ྗ͠ɺ͞΋ͳ ͘͹ʮϚον͠ͳ͔ͬͨʯΛग़ྗ͢Δɻ ‣ ࣮ࡍ͸/'"ܕɾ%'"ܕɾ7.ܕͳͲͱݺ͹ΕΔ࣮૷ํ਑͕ଘࡏ͠ ͓ͯΓɺͦΕͧΕҟͳΔར఺ɾܽ఺Λ࣋ͭɻ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ /'"ϕʔεͷਖ਼نදݱΤϯδϯ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ /'"ϕʔεͷΞϧΰϦζϜͷར఺ͱܽ఺ ‣ ར఺࣮૷͕༰қ ‣ ܽ఺ඇܾఆੑ
OPOEFUFSNJOJTN ͷ໰୊ ‣ ೖྗ஋͔Β࣍ͷભҠઌঢ়ଶ͕Ұҙʹఆ·Βͳ͍ɻ ‣ ભҠઌঢ়ଶ͕Ұҙʹఆ·Βͳ͍࣌ͷํ਑ͷྫ ‣ #BDLUSBDLJOH ‣ ભҠީิͷ͏ͪͲΕ͔ʹભҠ͠ɺͩΊͳΒผͷީิΛࢼ͢ɺΛ܁Γฦ͢ɻ ‣ ,FO5IPNQTPOT"MHPSJUIN ‣ ಉ࣌ʹෳ਺ީิΛࢼ͍ͯ͘͠ JFPOUIFqZͷႈू߹ߏ੒ ɻ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ όοΫτϥοΫͷྫ ਖ਼نදݱͷཧ࿦ͱ࣮૷ ‣ ҎԼͷ /'" ਖ਼نදݱB
Cͱ౳Ձ ʹೖྗ஋BDCΛ༩͑Δɻ ‣ ೖྗ஋தͷࠓ஫໨͍ͯ͠ΔจࣈBDC ‣ ࣍ͷঢ়ଶભҠ࢝ঢ়ଶˠঢ়ଶ ϵ

Cͱ౳Ձ ʹೖྗ஋BDCΛ༩͑Δɻ ‣ ೖྗ஋தͷࠓ஫໨͍ͯ͠ΔจࣈBDC ‣ ࣍ͷঢ়ଶભҠෳ਺ީิ͕͋Δ ˠ ˠͷͭͷ ભҠೖ ྗ஋Λফඅ͠ͳ͍ભҠ ɻ͜͜Ͱ͸ࢼ͠ʹ͔ΒʹਐΜͰΈΔɻ ϵ ϵ

Cͱ౳Ձ ʹೖྗ஋BDCΛ༩͑Δɻ ‣ ೖྗ஋தͷࠓ஫໨͍ͯ͠ΔจࣈBDC ‣ ࣍ͷঢ়ଶભҠࠓண໨͍ͯ͠Δจࣈ͸DͳͷͰ͔ΒભҠͰ͖ͳ ͍ɻͳͷͰઌఔࢼ͠ʹʹਐΜͩͷΛऔΓ΍ΊͯɺʹભҠ͢Δɻ ϵ

Cͱ౳Ձ ʹೖྗ஋BDCΛ༩͑Δɻ ‣ ೖྗ஋தͷࠓ஫໨͍ͯ͠ΔจࣈBDC ‣ ࣍ͷঢ়ଶભҠˠ ʹΑΔભҠ ϵ

Cͱ౳Ձ ʹೖྗ஋BDCΛ༩͑Δɻ ‣ ೖྗ஋தͷࠓ஫໨͍ͯ͠ΔจࣈBDC ‣ ࣍ͷঢ়ଶભҠˠ ભҠ ϵ ϵ

Cͱ౳Ձ ʹೖྗ஋BDCΛ༩͑Δɻ ‣ ೖྗ஋தͷࠓ஫໨͍ͯ͠ΔจࣈBDC ‣ ࣍ͷঢ়ଶભҠˠ CʹΑΔભҠ ϵ

Cͱ౳Ձ ʹೖྗ஋BDCΛ༩͑Δɻ ‣ ೖྗ஋தͷࠓ஫໨͍ͯ͠ΔจࣈBDC ‣ ೖྗ஋ΛશͯಡΈ͖͓ͬͯΓɺ͔ͭऴঢ়ଶ͕डཧঢ়ଶͳͷͰɺจࣈ ྻϚονʹ੒ޭͨ͜͠ͱ͕Θ͔Δɻ ϵ

ਖ਼نදݱͱ੬ऑੑ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ηΩϡϦςΟత؍఺ ਖ਼نදݱͱ੬ऑੑ ‣ ਖ਼نදݱͷ؍఺ਖ਼֬͞ͱύϑΥʔϚϯε ‣ ਖ਼֬ͦ͞ͷਖ਼نදݱ͸ॴ๬ͷݕࡧΛ࣮ݱ͢Δͷʹ଍Δ΋ͷ͔ɻ ‣
໰จࣈྻT͕KQHͰऴΘΔจࣈྻ͔Ͳ͏͔Λௐ΂͍ͨͱ͖ʹɺ SFNBUDI S aKQH T ͷ݁ՌΛར༻͢Δͷ͸ద੾͔Ͳ͏͔ߟ͑Αɻ ‣ ౴͜ΕͰ͸Tͱͯ͠IPHFKQHIUNM౳ͷจࣈྻ΋ڐ༰͞Εͯ͠·͏ɻ ‣ ਖ਼نදݱʹ͸ͨ͘͞Μͷམͱ͕݀͠ʜ ࢀߟBUUBDLFSDBOSFHFYQTFDVSJUZDIFBUTIFFU IUUQTHJUIVCDPNBUUBDLFSDBOSFHFYQTFDVSJUZDIFBUTIFFU ‣ ύϑΥʔϚϯεͦͷਖ਼نදݱʹ͔͔ΔϦιʔε͸ݱ࣮త͔ɻ ‣ ໰ਖ਼نදݱͷධՁʹ͔͔ΔϦιʔε͕ലେʹͳΔ͜ͱ͸͋Δ͔ɻ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ʮ͋Εɺݕࡧ͕ऴΘΒͳ͍ʜʯ ਖ਼نදݱͱ੬ऑੑ ‣ ؍࡯্ड़ͷ1ZUIPOεΫϦϓτͷධՁ͸ݱ࣮తͳ࣌ؒͰऴΘΒͳ ͍ɻ ‣ ཧ༝େྔͷόοΫτϥοΫ͕ൃੜ͢Δ͜ͱɻ ‣
1ZUIPOͷSF͸/'"ϕʔεͷΤϯδϯͰ͋ΓɺભҠઌͷঢ়ଶ͕Ұҙ ʹఆ·Βͳ͍৔߹ʹ͸όοΫτϥοΫΛߦ͏ɻ ‣ ͷΑ͏ͳωετͨ͠ྔԽࢠ͕ਖ਼نදݱதʹؚ·Ε͍ͯΔ͜ͱʹΑ ΓɺBBBBBBதͷBͷݸ਺Λ ͱͨ࣌͠ʹɺ ճఔ౓ͷόοΫ τϥοΫ͕ىͬͯ͜͠·͏ɻ n O(2n) import re; re.match(r'^(.*)*a$', 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaa!')

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ? BʹରԠ͢Δ /'" ਖ਼نදݱͱ੬ऑੑ ϵ ‣
ঢ়ଶͱ ঢ়ଶͱͰͦΕͧΕϧʔϓ͕Ͱ͖͍ͯΔɻ ‣ ਖ਼نදݱதͰ͸ ʹ͋ͨΔ෦෼ɻ ‣ ಺ଆͷঢ়ଶ ͷϧʔϓͰೖྗ஋ΛԿจࣈফඅ͢Δ͔͕ࣗ༝Ͱ͋ Γɺ͔ͭ ͷϧʔϓࣗମ΋ ͷϧʔϓͰ܁Γฦ͞ΕΔʜ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ 3F%P4 3FHVMBSFYQSFTTJPO%FOJBMPG4FSWJDF ਖ਼نදݱͱ੬ऑੑ ‣ 3F%P4 3FHVMBSFYQSFTTJPO%FOJBMPG4FSWJDF
‣ ੬ऑͳਖ਼نදݱʹΑΔจࣈྻૢ࡞͕ඇৗʹ௕͍࣌ؒɾେ͖͍ۭؒΛར ༻͢Δ͜ͱΛ༻͍ͨ%P4 %FOJBMPG4FSWJDF ߈ܸͷ͜ͱɻ ‣ ੬ऑͳਖ਼نදݱʜ όοΫτϥοΩϯάࣜΤϯδϯ্Ͱ ͋Δจࣈྻ Λ༩͑ͨ࣌ʹɺͦͷ௕͞ʹؔ͠ඇઢܗ࣌ؒΛཁ͢Δਖ਼نදݱͷ͜ͱɻ ‣ ੬ऑͳਖ਼نදݱͱͯ͠͸ҎԼͷύλʔϯ͕૝ఆͰ͖Δɻ ‣ ։ൃऀ͕༻ҙͨ͠ਖ਼نදݱ ‣ ഽײ֮ͱͯ͠͸ใࠂ͞Ε͍ͯΔ3F%P4੬ऑੑͷେ൒͸ͪ͜ΒͷλΠϓ ‣ Ϣʔβʔೖྗ͔Βߏ੒͞Εͨਖ਼نදݱ ‣ JF3FHVMBS&YQSFTTJPO*OKFDUJPO 3FHFYQ*OKFDUJPO ʹΑΔ΋ͷ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ 3F%P4߈ܸͷݱ࣮ ਖ਼نදݱͱ੬ऑੑ ‣ ੈͷதʹग़ճ͍ͬͯΔϥΠϒϥϦɾιϑτ΢ΣΞதͷ3F%P4੬ऑ ੑ͸͠͹͠͹ใࠂ͞Ε͍ͯΔɻ ‣ ࢀߟ$"4UBJDVBOE.1SBEFM l'SFF[JOHUIF8FC"4UVEZPG3F%P47VMOFSBCJMJUJFTJO+BWB4DSJQUCBTFE8FC
4FSWFST zJOUI64&/*94FDVSJUZ4ZNQPTJVN 64&/*94FDVSJUZ QQr ‣ ࢀߟ+$%BWJT $"$PHIMBO '4FSWBOU BOE%-FF l5IF*NQBDUPG3FHVMBS&YQSFTTJPO%FOJBMPG4FSWJDF 3F%P4 JO1SBDUJDF"O&NQJSJDBM4UVEZBUUIF&DPTZTUFN4DBMF zJO1SPDFFEJOHTPGUIFUI"$.+PJOU .FFUJOHPO&VSPQFBO4PGUXBSF&OHJOFFSJOH$POGFSFODFBOE4ZNQPTJVNPOUIF'PVOEBUJPOTPG4PGUXBSF &OHJOFFSJOH QQr ‣ /PEFKT੡ͷϥΠϒϥϦʹ͓͚Δ3F%P4੬ऑੑ͸Α͘ใࠂ͞Εͯ ͍Δ͕ɺͦͷTJOHMFUISFBEੑΛؑΈΔͱɺ͜Ε͸େ໰୊ɻ ‣ ࢀߟ3F%P4WVMOFSBCJMJUJFTJOOQNTQJLFTCZBOE944DPOUJOVFTUPHSPXCZTOZL IUUQTTOZLJPCMPHSFEPTWVMOFSBCJMJUJFTJOOQNTQJLFTCZBOEYTTDPOUJOVFTUPHSPX

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ରࡦ ਖ਼نදݱͱ੬ऑੑ ‣ ਖ਼نදݱͷධՁʹ͔͚ͯΑ͍ϦιʔεΛ੍ݶ͢Δɻ ‣ /&5Ͱ͸ඪ४ͰλΠϜΞ΢τػೳ͕ఏڙ͞Ε͍ͯΔɻ IUUQTEPDTNJDSPTPGUDPNFOVTEPUOFUBQJ TZTUFNUFYUSFHVMBSFYQSFTTJPOTSFHFYNBUDIUJNFPVU
WJFXOFUGSBNFXPSL ‣ 1ZUIPOλΠϜΞ΢τػೳ෇͖ͷϞδϡʔϧ΋ଘࡏ͍ͯ͠Δɻ IUUQTQZQJPSHQSPKFDUSFHFY ‣ όοΫτϥοΫΛ͠ͳ͍λΠϓͷΤϯδϯΛར༻͢Δɻ ‣ ྫ3& IUUQTHJUIVCDPNHPPHMFSF ‣ ΞϯνύλϯΛආ͚Δɻ ‣ ྫྔԽࢠͷωετ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ #MJOE3FHFY*OKFDUJPO ਖ਼نදݱͱ੬ऑੑ ‣ ໰୊ҎԼͷ৚݅ԼͰɺจࣈྻTΛϦʔΫ͢Δख๏͸͋Δ͔ɻ ‣ ߈ܸऀ͸೚ҙͷਖ਼نදݱͰ͋ΔจࣈྻT্ΛݕࡧͰ͖Δɻ ‣ ͜ͷਖ਼نදݱͷධՁʹ͸λΠϜΞ΢τ
Uඵ ͕՝͞Ε͓ͯΓɺ͔ͭ όοΫτϥοΩϯάࣜͷΤϯδϯ͕ར༻͞Ε͍ͯΔɻ ‣ ߈ܸྫ#MJOE3FHFY*OKFDUJPO"UUBDL ‣ ԾఆU͕े෼ʹେ͖͍ɻ ‣ ख๏ʮจࣈྻT͕͋ΔจࣈྻY͔Β࢝·Δͱ͖ʹ͸ͦͷධՁʹUඵΛ ϑϧʹফඅ͠ 3F%P4߈ܸΛߦ͍ ɺͦΕҎ֎ͷ࣌ʹ௚ͪʹධՁ͕ऴྃ ͢ΔʯΑ͏ͳਖ਼نදݱΛߏ੒͠ɺݕࡧΛ܁Γฦ͢ɻ ‣ ࢀߟ"3PVHI*EFBPG#MJOE3FHVMBS&YQSFTTJPO*OKFDUJPO"UUBDL IUUQTEJBSZTIJGUKTJOGPCMJOESFHVMBSFYQSFTTJPOJOKFDUJPO

࠷ޙʹ

TIJGUKTJOGP ਖ਼نදݱͱηΩϡϦςΟ ࠷ޙʹ ਖ਼نදݱͱηΩϡϦςΟ ‣ ࠓ೔͸ҎԼͷ఺ʹ͍ͭͯ࿩ͨ͠ɻ ‣ ֶ෦Ͱ͠͹͠͹औΓѻΘΕΔਖ਼نදݱʹ·ͭΘΔ࿩ ‣ ͔ͦ͜Βࣗવʹ༠ಋ͞ΕΔηΩϡϦςΟ্ͷ໰୊
‣ ϝοηʔδ ‣ ֶ෦ͰऔΓѻΘΕΔجૅ஌ࣝͨͪ FH04࿦ άϥϑཧ࿦ ܗࣜݴޠཧ ࿦ ҉߸ ͸ɺҊ֎ ౰વ ࠓ೔ͷ৘ใࣾձΛࢧ͍͑ͯΔɻ ‣ ·ͨͦͷΑ͏ͳجૅ஌ࣝͨͪΛਖ਼࣋ͭ͘͜͠ͱ͸ɺ҆৺ɾ҆શͳϓϩ άϥϜΛॻ͘͜ͱ΍ηΩϡϦςΟϦεΫͷධՁʹ΋׆͖ͯ͘Δɻ ‣ ͦͯ͠ηΩϡϦςΟɾΩϟϯϓ͸جૅ஌ࣝΛಘΔ׆͔͢ͷʹ࠷దͳ ৔ɻͥͻηΩϡϦςΟɾΩϟϯϓʹ͝ԠืΛ

正規表現とセキュリティ / Regular Expressions and Their Security-Related Aspects

正規表現とセキュリティ / Regular Expressions and Their Security-Related Aspects

More Decks by Takashi Yoneuchi

Other Decks in Technology

Featured

Transcript