セキュリティ・キャンプ全国大会2016の講義資料です。 講義の前編は、はせがわようすけさんの資料をご覧ください。 http://www.slideshare.net/hasegawayosuke/ss-64924759
࣍ੈϓϥοτϑΥʔϜͷηΩϡϦςΟϞσϧߟʢޙฤʣגࣜձࣾϦΫϧʔτςΫϊϩδʔζαΠόʔηΩϡϦςΟΤϯδχΞϦϯά෦ଜ फߊ
View Slide
ଜ फߊʢʹ͠ΉͶ͋ʣגࣜձࣾϦΫϧʔτςΫϊϩδʔζαΠόʔηΩϡϦςΟΤϯδχΞϦϯά෦ࠃܞଳిϝʔΧʔͰͷίϯαϧςΟϯάͳͲΛܦͯɺ݄ΑΓݱ৬ɻϦΫϧʔτͷ*%ཧج൫ͷηΩϡϦςΟอकϦΫϧʔτάϧʔϓશମͷ੬ऑੑमਖ਼ࢧԉʹܞΘΔɻझຯϒϥβͷ੬ऑੑ୳͠ɻஶॻʹϒϥβϋοΫʢ༁ʣɻߨԋྺʹ8PP:VO 8IJUF)BU'FTU ɺ $0%& #-6&ɺ "750,:0 ͳͲ
લͷߨٛɺ͕ͤΘΑ͏͚͢͞ΜͷࢿྉΛࢀরhttp://www.slideshare.net/hasegawayosuke/ss-64924759
8FCͱ/BUJWFΞϓϦΛͭͳ͙ٕज़
ϞόΠϧ8FC /BUJWFΞϓϦ˓ )5.-Ͱϫϯιʔε։ൃ ☓ 04͝ͱʹҟͳΔϓϩάϥϜݴޠͰ։ൃ˓ 63-Λ։͚ͩ͘Ͱ࣮ߦ ☓ ࣮ߦʹΠϯετʔϧ͕ඞཁ☓ར༻Ͱ͖Δͷػೳʹ੍ݶྫʣ௨ ϑΝΠϧૢ࡞ͳͲېࢭ˓༷ʑͳͷػೳΛ͑Δྫʣ֤छηϯαʔ /'$ͳͲར༻Մೳ☓ར༻Ͱ͖Δ௨৴ϓϩτίϧʹ੍ݶྫʣ)551 8FC35$ͳͲʹݶఆ˓ҙͷ௨৴ϓϩτίϧΛ࣮Մೳྫʣ44) *."1ͳͲجຊతʹࣗ༝ϞόΠϧ8FC PS/BUJWFΞϓϦ
ϞόΠϧ8FC /BUJWFΞϓϦ˓ )5.-Ͱϫϯιʔε։ൃ ☓ 04͝ͱʹҟͳΔϓϩάϥϜݴޠͰ։ൃ˓ 63-Λ։͚ͩ͘Ͱ࣮ߦ ☓ ࣮ߦʹΠϯετʔϧ͕ඞཁ☓ར༻Ͱ͖Δͷػೳʹ੍ݶྫʣ௨ ϑΝΠϧૢ࡞ͳͲېࢭ˓༷ʑͳͷػೳΛ͑Δྫʣ֤छηϯαʔ /'$ͳͲར༻Մೳ☓ར༻Ͱ͖Δ௨৴ϓϩτίϧʹ੍ݶྫʣ)551 8FC35$ͳͲʹݶఆ˓ҙͷ௨৴ϓϩτίϧΛ࣮Մೳྫʣ44) *."1ͳͲجຊతʹࣗ༝ϞόΠϧ8FC PS/BUJWFΞϓϦ/BUJWFΞϓϦϚϧν1'ల։ͱϢʔβʔϦʔνʹ՝ϞόΠϧ8FCػೳෆ͕՝
8FCͷػೳෆΛิ͏ٕज़• +BWB4DSJQU +4ͱ/BUJWFͷϓϩάϥϜΛ૬ޓʹͭͳ͙Έͷొ• 8FCʹΓͳ͍ػೳ/BUJWFݴޠͰ࣮ͯ͠+4͔Βݺͼग़͢J04ΞϓϦ8,8FC7JFX/BUJWFͷؔΛݺͼग़࣮͢ߦ݁ՌΛ+4ʹ௨͢Δ
+4à /BUJWFBEE+BWBTDSJQU*OUFSGBDF "OESPJE8,4DSJQU.FTTBHF)BOEMFS J04QSPNQU "OESPJE J04/BUJWFà +4FWBMVBUF+BWB4DSJQU "OESPJE J048,6TFS4DSJQU J04+4ͱ/BUJWFΛͭͳ͙ํ๏ʢҰྫʣ
BEE+BWBTDSJQU*OUFSGBDF "OESPJEwebview.addJavascriptInterface(new MyClass(), "myclass"); +BWB• .Z$MBTTΠϯελϯεΛNZDMBTTͱ͍͏໊લͰ+4͔Βૢ࡞Ͱ͖ΔΑ͏ઃఆmyclass.func("Hello from JS"); +4• NZDMBTTΦϒδΣΫτΛհͯ͠+BWBͷ.Z$MBTTΠϯελϯεΛૢ࡞
8,4DSJQU.FTTBHF)BOEMFS J04• NZ)BOEMFSͱ͍͏໊લͰ+4͔ΒϝοηʔδΛड͚ΒΕΔΑ͏ઃఆcontroller.addScriptMessageHandler(self, name: "myHandler") 4XJGUfunc userContentController(userContentController:WKUserContentController,didReceiveScriptMessage message: WKScriptMessage) { // ToDo }4XJGU• +4͔ΒͷϝοηʔδΛड৴͢ΔͨΊͷϋϯυϥؔΛఆٛwebkit.messageHandlers.myHandler.postMessage("Hello from JS "); +4• +4͔Β4XJGUϝοηʔδΛૹ৴
webview.setWebChromeClient(new WebChromeClient() {public boolean onJsPrompt(WebView view, String url, String message,String defaultValue, final JsPromptResult result) { // To Do }});QSPNQU "OESPJE• +4ͷQSPNQUؔݺͼग़͠ΛϑοΫ͢ΔͨΊͷϋϯυϥΛఆٛ+BWBvar result = prompt("Hello from JS"); +4• +4ͰQSPNQUؔΛݺͼग़͢ͱ্هͷPO+T1SPNQU͕࣮ߦ͞ΕΔ
func webView(webView: WKWebView,runJavaScriptTextInputPanelWithPrompt prompt: String,defaultText: String?, initiatedByFrame frame: WKFrameInfo,completionHandler: (String?) -> Void) { // ToDo }QSPNQU J04• +4ͷQSPNQUؔݺͼग़͠ΛϑοΫ͢ΔͨΊͷEFMFHBUFΛఆٛ4XJGUvar result = prompt("Hello from JS"); +4• +4ͰQSPNQUؔΛݺͼग़͢ͱ্هͷEFMFHBUF͕࣮ߦ͞ΕΔ
FWBMVBUF+BWB4DSJQU "OESPJE J04• จࣈྻΛ8FC7JFXʹೖ͠ɺ+4ͱ࣮ͯ͠ߦString source = "alert('Hello from Java')";webview.evaluateJavascript(source, null);+BWBlet source = "alert('Hello from Swift')"webview.evaluateJavaScript(source, completionHandler: nil)4XJGU
8,6TFS4DSJQU J04• ͋Β͔͡Ίొ͓͍ͯͨ͠+4Λ8FCϖʔδͷભҠຖʹࣗಈ࣮ߦlet source = "alert('Hello from Swift')”let script = WKUserScript(source: source, injectionTime: .AtDocumentEnd,forMainFrameOnly: true)webview.configuration.userContentController.addUserScript(script)4XJGU
ϒϥβΞϓϦʹ͓͚Δ׆༻ࣄྫʢϖʔδݕࡧʣ/BUJWF͔Β+4Λೖͯ͠จࣈΛϋΠϥΠτදࣔhttps://github.com/mozilla/firefox-ios/blob/v4.x/Client/Frontend/Browser/FindInPageHelper.swift#L26
ϒϥβΞϓϦʹ͓͚Δ׆༻ࣄྫʢ1BTTXPSE.BOBHFSʣhttps://github.com/mozilla/firefox-ios/blob/v4.x/Client/Frontend/Browser/LoginsHelper.swift#L222+4Λೖͯ͠GPSNʹύεϫʔυΛࣗಈೖྗ
8FCͱ/BUJWFΞϓϦͷͭͳ͗ͷ෦ʹજΉ੬ऑੑ
૾ͯ͠ΈΑ͏• 1BTTXPSE.BOBHFS͕͠ޡͬͯҟͳΔαΠτʹύεϫʔυΛೖྗͨ͠Βʁ• ͜ͷΑ͏ͳޡΓͲ͏ͯ͠ى͖ΔΜͩΖ͏ʁޡͬͯύεϫʔυΛࣗಈೖྗ
8FCͱ/BUJWFͷͭͳ͗Ͱੜ͡Δͭͷ੬ऑੑ0SJHJO 7BMJEBUJPO&SSPS/BUJWFͷػೳΛݺͼग़ͨ͠8FCαΠτͷΦϦδϯͷݕূෆඋɻຊདྷڐՄ͠ͳ͍8FCαΠτʹ/BUJWFͷػೳΛѱ༻͞ΕΔڪΕ'SBNF$POGVTJPOJGSBNFͷϖʔδ͔ΒͷཁٻͱXJOEPX͔Βͷཁٻͷࠞಉɻ0SJHJO7BMJEBUJPO&SSPSͱಉ༷ͷඃ͕ੜ͡ΔڪΕ+BWB4DSJQU *OKFDUJPOୈࡾऀ͔Β͞ΕͨจࣈྻΛ+4ͱͯ͠8FC7JFXʹೖɻѱҙͷ͋Δ+4Λ࣮ߦͤ͞ΒΕΔڪΕ˞8FCαΠτ͕$41Ͱอޢ͞Ε͍ͯͯ+4͕࣮ߦ͞ΕΔ˞
ԋश
߈ܸରͷΞϓϦʮ4FDVSF#PPLNBSLʯ• ར༻ऀͷϒοΫϚʔΫΛ҆શʹཧ͢ΔΞϓϦ• "OESPJEҎ্ͱJ04Ҏ্ʹରԠ• ར༻ऀͷϩάΠϯใ1BTTXPSE.BOBHFS͕҆શʹࣗಈೖྗ
᠘αΠτΛߏங͠ɺύεϫʔυΛ౪Έग़͢• 4FDVSF#PPLNBSLͷίʔυΛಡΜͰ1BTTXPSE.BOBHFSͷ੬ऑੑΛݟ͚ͭΔIUUQTHJUIVCDPNOJTIJNVOFBTFDVSJUZDBNQ• ᠘αΠτ͔Β੬ऑੑΛ߈ܸɻޡͬͯࣗಈೖྗ͞ΕͨύεϫʔυΛ౪Έग़͢᠘αΠτΛϒοΫϚʔΫ੬ऑੑΛ߈ܸͯ͠ύεϫʔυΛऔಘ͜ΕΛ౪Έग़͢
ͷώϯτ2VFTUJPO0SJHJO7BMJEBUJPO&SSPSͷ੬ऑੑ͕͋Δͧɻ1BTTXPSE.BOBHFS͕8FC7JFXʹຒΊࠐΉ+4ͷίʔυʹணͯ͠ΈΑ͏2VFTUJPO 0SJHJO7BMJEBUJPO&SSPSͷ੬ऑੑ͕͋Δͧɻ1BTTXPSE.BOBHFS͕+4ͷίʔυΛຒΊࠐΉ݅ʹணͯ͠ΈΑ͏2VFTUJPO0SJHJO7BMJEBUJPO&SSPSͷ੬ऑੑ͕͋Δͧɻ1BTTXPSE.BOBHFS͕ͲͷΑ͏ʹݺͼग़͞ΕΔ͔ௐͯΈΑ͏2VFTUJPO+BWB4DSJQU*OKFDUJPOͷ੬ऑੑ͕͋Δͧɻ1BTTXPSE.BOBHFS͕ຒΊࠐΉ+4ͷίʔυʹணͯ͠ΈΑ͏2VFTUJPO'SBNF$POGVTJPOͷ੬ऑੑ͕͋Δͧɻ1BTTXPSE.BOBHFS͕+4ͷίʔυΛຒΊࠐΉ݅ʹணͯ͠ΈΑ͏ɻJ04൛3BDF $POEJUJPOΛͬͯղ͘ํ๏͋Δͧ
͜ͷΑ͏ͳ੬ऑੑΛ͙ʹ
0SJHJO7BMJEBUJPO&SSPS• Α͋͘Δ࣮ޡΓ• 63-ʹʮTFDVSJUZDBNQPSHʯͱ͍͏จࣈྻؚ͕·ΕΔ͜ͱΛݕূ- IUUQFWJMFYBNQMFDPNTFDVSJUZDBNQPSH ͳͲͰᷖճ͞ΕΔ• 63-͕ʮIUUQTFDVSJUZDBNQPSHʯͱ͍͏จࣈྻͰ։࢝͢Δ͜ͱΛݕূ- IUUQTFDVSJUZDBNQPSHFWJMFYBNQMFDPN ͳͲͰᷖճ͞ΕΔ• 04ͷ"1*Ͱ63-Λ֤ύʔτʹղ͠ɺ֤ʑΛશҰகͰൺֱhttps://www.ietf.org/rfc/rfc3986.txtIUUQTBENJO!FYBNQMFDPN PWFSUIFSF OBNFGFSSFUOPTFTDIFNF VTFSJOGP IPTU QPSU QBUI RVFSZ GSBHNFOU
'SBNF$POGVTJPO• 8FC7JFXΦϒδΣΫτͷ63-Ͱͳ͘ɺϦΫΤετݩͷ63-Λݕূ• ΟϯυʢXJOEPXUPQʣͰͳ͘ϦΫΤετݩͷϑϨʔϜΛݕূ• ࣮ʹϦΫΤετݩͷ63-ΛݕূՄೳͳ"1*Λ͏ඞཁ͕͋Δ+4à /BUJWFBEE+BWBTDSJQU*OUFSGBDF • ϦΫΤετݩͷ63-औಘෆՄ8,4DSJQU.FTTBHF)BOEMFS• VTFS$POUFOU$POUSPMMFSͷҾNFTTBHFͷGSBNF*OGPTFDVSJUZ0SJHJOΛݕূʢJ04Ҏ߱ʣQSPNQU• PO+T1SPNQUͷҾVSMΛݕূʢ"OESPJEʣ• SVO+BWB4DSJQU5FYU*OQVU1BOFM8JUI1SPNQUͷҾGSBNFTFDVSJUZ0SJHJOΛݕূʢJ04Ҏ߱ʣ
+BWB4DSJQU*OKFDUJPO• ྫ͑ɺFWBMVBUF+BWB4DSJQUΛආ͚Δ• จࣈྻ࿈݁Ͱ+4Λಈతੜ͢ΔՕॴͦͦޡΓΛ࡞ΓࠐΈ͍͢• QSPNQUͷΑ͏ʹ+4ͱ/BUJWFؒͰσʔλΛͤΔํ๏ͷ༻Λݕ౼͢Δ• Ͳ͏ͯ͠+4Λੜ͢ΔͳΒɺจࣈྻͷΤεέʔϓॲཧͰؤுΔ• +4ʹৄ͍͠ਓʹͪΌΜͱϨϏϡʔͯ͠Β͓͏• WBS OBNF͜͜ Λಈతੜ͢ΔࡍʹΤεέʔϓ͕ඞཁͱͳΔจࣈʁ6" -' 6$ 6% $3 6 -46 6 14
·ͱΊ
·ͱΊ• 8FCͱ/BUJWFΛͭͳ͙ඞཁੑ͖ͬͱࠓޙ͋Δ• ͭͳ͗ํΛޡΔͱѱ͍αΠτʹ/BUJWFͷػೳΛѱ༻͞ΕΔ• ѱ༻͞Εͳ͍Α͏ʹ࣮͢ΔͷΞϓϦ։ൃऀͷ• ࣮ͷํ04ϑϨʔϜϫʔΫͷఏڙ͢ΔΈʹΑͬͯҟͳΔ
͓ΘΓ
nishimunea
fujiwara3
peisuke
coconala_engineer
muziyoshiz
sat
lemiorhan
iamshunta
niftycorp
nagix
takasehideki
kei_s
aoshun7
chriscoyier
bkeepers
chrisshort
jacobian
erikaheidi
deanohume
ddemaree
zenorocha
malarkey
tammyeverts
phodgson