Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
徳丸最終回
Search
mcz9mm
August 30, 2017
0
76
徳丸最終回
mcz9mm
August 30, 2017
Tweet
Share
More Decks by mcz9mm
See All by mcz9mm
SwiftUI-List-Pagination
mcz9mm
2
2.2k
ARKit2.0でAppleが伝えたいアプリ体験を考える
mcz9mm
2
1.1k
ゆるく学ぶARKit
mcz9mm
3
1.4k
What’s TCP/UDP?
mcz9mm
0
100
NATサーバーの必要性
mcz9mm
0
87
What’s New in ARKit2.0
mcz9mm
0
87
徳丸本 ログインフォーム
mcz9mm
0
98
arkit+animoji
mcz9mm
0
64
徳丸本8
mcz9mm
0
110
Featured
See All Featured
We Have a Design System, Now What?
morganepeng
51
7.4k
Documentation Writing (for coders)
carmenintech
68
4.6k
StorybookのUI Testing Handbookを読んだ
zakiyama
28
5.5k
The Straight Up "How To Draw Better" Workshop
denniskardys
232
140k
Automating Front-end Workflow
addyosmani
1369
200k
Facilitating Awesome Meetings
lara
53
6.2k
Bash Introduction
62gerente
611
210k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
666
120k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
233
17k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
32
2.1k
Adopting Sorbet at Scale
ufuk
75
9.2k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
30
2.2k
Transcript
ϑΝΠϧμϯϩʔυʹΑΔXSS ಙؙձ
AJENDA ▸ ֓ཁ ▸ ख๏ͱӨڹ ▸ ݪҼ ▸ ରࡦ
֓ཁ μϯϩʔυʹΑΔJSͷ࣮ߦ Ξοϓϩʔυ ը૾ μϯϩʔυ
֓ཁ ը૾σʔλʹࠐΉ ▸ ΞοϓϩʔυΛ͢Δࡍͷը૾ɺpngjpgͱͯ͠ೝࣝ͢Δ͕ͣͩɺը૾σʔλͷ தʹHTMLλάؚ͕·Ε͍ͯΔͱ݅ʹΑͬͯHTMLϑΝΠϧͱͯ͠ೝࣝ͞Εͯ͠· ͏ ▸ ͜ͷ੬ऑੑΛར༻ͯ͠ɺѱҙͷ͋Δͷ͕ը૾σʔλʹHTMLJavaScriptΛࠐΜ ͰΞοϓϩʔυͯ͠߈ܸΛߦ͏
֓ཁ ରࡦ ▸ ϑΝΠϧͷContent-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ֦ுࢠͱը૾ͷத͕ରԠ͍ͯ͠Δ͜ͱΛ֬ೝ ▸ μϯϩʔυΛఆͨ͠ϑΝΠϧʹɺϨεϙϯεϔομͱ ͯ͠ʮContent-Disposition:attachmentʯΛࢦఆ͢Δ
߈ܸख๏ͱӨڹ ը૾ϑΝΠϧʹΑΔXSS ▸ IE8͔Βରࡦ͞Ε͍ͯΔ͕IE7Ҏલରࡦ͕ඞཁ Hoge.png <script>alert(‘XSS’);</script> ▸ IE8ςΩετͱͯ͠දࣔ͞Ε͍ͯΔ͕IE7ҎલͰ࣮ߦ͞Ε ͯ͠·͏
߈ܸख๏ͱӨڹ PDFμϯϩʔυը໘ʹΑΔXSS http://hoge.jp/fuga/nuge.php?file=614614891.pdf ▸ PDFʹPATHINFOͱݺΕΔݟ্͔͚ϑΝΠϧ໊ͷΑ͏ͳ ܗͰURLʹύϥϝʔλΛຒΊࠐΉ͜ͱ͕Ͱ͖Δ http://hoge.jp/fuga/nuge.php/a.html?file=614614891.pdf ▸ a.htmlଘࡏ͠ͳ͍ϑΝΠϧͳͷͰύϥϝʔλͱͯ͠εΫϦ ϓϓτʹ͞ΕΔ
ରࡦ ϑΝΠϧΞοϓϩʔυ࣌ͷରࡦ ▸ ֦ுࢠ͕ڐՄ͞Εͨͷ͔νΣοΫ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ϚδοΫόΠτͱɺϑΝΠϧࣝผͷͨΊʹϑΝΠϧͷઌ಄ ʹஔ͔Εͨݻఆͷจࣈྻͷ͜ͱ
ରࡦ ϚδοΫόΠτͷ֬ೝ array getimagesize(string $filename [, array &$imageinfo]) ▸ ฦΓ
1. 1: IMAGETYPE_GIF 2. 2: IMAGETYPE_JPEG 3. 3: IMAGETYPE_PNG
ରࡦ ϑΝΠϧμϯϩʔυ࣌ͷରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ
ରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ XSSͷ੬ऑੑContent-Typeͷؒҧ͍͕ݪҼ ▸ PDFܗࣜͷContent-TypeΛ[application/pdf]ͱઃఆ͢Δ͚ͩ Ͱ੬ऑੑͳ͘ͳΔ
ରࡦ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ ▸ μϯϩʔυͨ͠ϑΝΠϧΛΞϓϦέʔγϣϯͰར༻ͤͣɺ μϯϩʔυͰ͖͑͢͞Εྑ͍߹ɺʮContent- Disposition: attachmentʯͱ͍͏ϨεϙϯεϔομΛࢦఆ͢ Δ ▸
͜ͷ߹Content-Typeʮapplication/octet-streamʯʹ ͢ΔͱϑΝΠϧϔομ্ʮμϯϩʔυ͖͢ϑΝΠϧʯ ʹͳΔ
·ͱΊ ͷجຊ ▸ Content-Typeͱ֦ுࢠΛਖ਼͘͠ઃఆ͢Δ͜ͱ
Ҏ্