Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
徳丸最終回
Search
mcz9mm
August 30, 2017
0
88
徳丸最終回
mcz9mm
August 30, 2017
Tweet
Share
More Decks by mcz9mm
See All by mcz9mm
SwiftUI-List-Pagination
mcz9mm
2
2.3k
ARKit2.0でAppleが伝えたいアプリ体験を考える
mcz9mm
2
1.1k
ゆるく学ぶARKit
mcz9mm
3
1.5k
What’s TCP/UDP?
mcz9mm
0
110
NATサーバーの必要性
mcz9mm
0
110
What’s New in ARKit2.0
mcz9mm
0
110
徳丸本 ログインフォーム
mcz9mm
0
110
arkit+animoji
mcz9mm
0
72
徳丸本8
mcz9mm
0
130
Featured
See All Featured
Designing for Performance
lara
610
69k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
addyosmani
7
890
ReactJS: Keep Simple. Everything can be a component!
pedronauck
667
120k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
285
14k
Testing 201, or: Great Expectations
jmmastey
45
7.7k
Reflections from 52 weeks, 52 projects
jeffersonlam
352
21k
Optimizing for Happiness
mojombo
379
70k
Unsuck your backbone
ammeep
671
58k
How STYLIGHT went responsive
nonsquared
100
5.8k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
irinanazarova
9
960
Keith and Marios Guide to Fast Websites
keithpitt
411
22k
Transcript
ϑΝΠϧμϯϩʔυʹΑΔXSS ಙؙձ
AJENDA ▸ ֓ཁ ▸ ख๏ͱӨڹ ▸ ݪҼ ▸ ରࡦ
֓ཁ μϯϩʔυʹΑΔJSͷ࣮ߦ Ξοϓϩʔυ ը૾ μϯϩʔυ
֓ཁ ը૾σʔλʹࠐΉ ▸ ΞοϓϩʔυΛ͢Δࡍͷը૾ɺpngjpgͱͯ͠ೝࣝ͢Δ͕ͣͩɺը૾σʔλͷ தʹHTMLλάؚ͕·Ε͍ͯΔͱ݅ʹΑͬͯHTMLϑΝΠϧͱͯ͠ೝࣝ͞Εͯ͠· ͏ ▸ ͜ͷ੬ऑੑΛར༻ͯ͠ɺѱҙͷ͋Δͷ͕ը૾σʔλʹHTMLJavaScriptΛࠐΜ ͰΞοϓϩʔυͯ͠߈ܸΛߦ͏
֓ཁ ରࡦ ▸ ϑΝΠϧͷContent-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ֦ுࢠͱը૾ͷத͕ରԠ͍ͯ͠Δ͜ͱΛ֬ೝ ▸ μϯϩʔυΛఆͨ͠ϑΝΠϧʹɺϨεϙϯεϔομͱ ͯ͠ʮContent-Disposition:attachmentʯΛࢦఆ͢Δ
߈ܸख๏ͱӨڹ ը૾ϑΝΠϧʹΑΔXSS ▸ IE8͔Βରࡦ͞Ε͍ͯΔ͕IE7Ҏલରࡦ͕ඞཁ Hoge.png <script>alert(‘XSS’);</script> ▸ IE8ςΩετͱͯ͠දࣔ͞Ε͍ͯΔ͕IE7ҎલͰ࣮ߦ͞Ε ͯ͠·͏
߈ܸख๏ͱӨڹ PDFμϯϩʔυը໘ʹΑΔXSS http://hoge.jp/fuga/nuge.php?file=614614891.pdf ▸ PDFʹPATHINFOͱݺΕΔݟ্͔͚ϑΝΠϧ໊ͷΑ͏ͳ ܗͰURLʹύϥϝʔλΛຒΊࠐΉ͜ͱ͕Ͱ͖Δ http://hoge.jp/fuga/nuge.php/a.html?file=614614891.pdf ▸ a.htmlଘࡏ͠ͳ͍ϑΝΠϧͳͷͰύϥϝʔλͱͯ͠εΫϦ ϓϓτʹ͞ΕΔ
ରࡦ ϑΝΠϧΞοϓϩʔυ࣌ͷରࡦ ▸ ֦ுࢠ͕ڐՄ͞Εͨͷ͔νΣοΫ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ϚδοΫόΠτͱɺϑΝΠϧࣝผͷͨΊʹϑΝΠϧͷઌ಄ ʹஔ͔Εͨݻఆͷจࣈྻͷ͜ͱ
ରࡦ ϚδοΫόΠτͷ֬ೝ array getimagesize(string $filename [, array &$imageinfo]) ▸ ฦΓ
1. 1: IMAGETYPE_GIF 2. 2: IMAGETYPE_JPEG 3. 3: IMAGETYPE_PNG
ରࡦ ϑΝΠϧμϯϩʔυ࣌ͷରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ
ରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ XSSͷ੬ऑੑContent-Typeͷؒҧ͍͕ݪҼ ▸ PDFܗࣜͷContent-TypeΛ[application/pdf]ͱઃఆ͢Δ͚ͩ Ͱ੬ऑੑͳ͘ͳΔ
ରࡦ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ ▸ μϯϩʔυͨ͠ϑΝΠϧΛΞϓϦέʔγϣϯͰར༻ͤͣɺ μϯϩʔυͰ͖͑͢͞Εྑ͍߹ɺʮContent- Disposition: attachmentʯͱ͍͏ϨεϙϯεϔομΛࢦఆ͢ Δ ▸
͜ͷ߹Content-Typeʮapplication/octet-streamʯʹ ͢ΔͱϑΝΠϧϔομ্ʮμϯϩʔυ͖͢ϑΝΠϧʯ ʹͳΔ
·ͱΊ ͷجຊ ▸ Content-Typeͱ֦ுࢠΛਖ਼͘͠ઃఆ͢Δ͜ͱ
Ҏ্