Upgrade to Pro — share decks privately, control downloads, hide ads and more …

hatena-diary-blog-xss

 hatena-diary-blog-xss

はてなダイアリーやブログのXSS対策の事例を紹介します

Yasuhiro Onishi

May 14, 2013
Tweet

More Decks by Yasuhiro Onishi

Other Decks in Technology

Transcript

  1. μΠΞϦʔͱϒϩάͱ
    944
    גࣜձࣾ͸ͯͳ
    JEPOJTIJ
    !4IJCVZB944JO0TBLB

    View full-size slide

  2. ࣗݾ঺հ
    wJEPOJTIJେ੢߁༟
    wגࣜձࣾ͸ͯͳ
    wνʔϑΤϯδχΞ
    w͸ͯͳϒϩάσΟϨΫλʔ

    View full-size slide

  3. ͸ͯͳͱݴ͑͹944

    View full-size slide

  4. ͸ͯͳͱ944
    wਓྗݕࡧ͸ͯͳRIBUFOBOFKQ
    w͸ͯͳΞϯςφBIBUFOBOFKQ
    w͸ͯͳμΠΞϦʔEIBUFOBOFKQ
    w͸ͯͳϒοΫϚʔΫCIBUFOBOFKQ

    View full-size slide

  5. ͸ͯͳͱ944
    wಉҰυϝΠϯɾಉҰΫοΩʔʹΑΔ
    Ϣʔβʔೝূ
    wΫοΩʔΛୣΘΕͨΒηογϣϯϋ
    ΠδϟοΫ͞ΕಘΔ

    View full-size slide

  6. ͸ͯͳμΠΞϦʔ
    w೥ϦϦʔεͷϒϩάαʔϏε
    w؅ཧը໘ͱϒϩάը໘͕ಉҰυϝΠϯ
    wϒϩάαʔϏεˠϢʔβʔίϯςϯπ

    View full-size slide

  7. ͦͷ৔ฤू

    View full-size slide

  8. ͦͷ৔ฤू

    View full-size slide

  9. Ϣʔβʔίϯςϯπ
    w޷͖ͳ͜ͱΛॻ͖͍ͨ
    w޷͖ͳσβΠϯʹ͍ͨ͠
    w޷͖ͳϒϩάύʔπΛ࢖͍͍ͨ

    View full-size slide

  10. Ϣʔβʔརศੑͱ
    ҆શੑͷཱ྆

    View full-size slide

  11. Ϣʔβʔίϯςϯπ
    w޷͖ͳ͜ͱΛॻ͖͍ͨˠ)5.-944
    w޷͖ͳσβΠϯʹ͍ͨ͠ˠ$44944
    w޷͖ͳϒϩάύʔπΛ࢖͍͍ͨˠººº

    View full-size slide

  12. )5.-ͷ944ରࡦ
    wར༻Մೳཁૉ
    wར༻Մೳଐੑ
    wελΠϧཁૉ
    wΠϯϥΠϯ$44

    View full-size slide

  13. ஫ҙ͢΂͖ཁૉ
    wTDSJQU
    wPCKFDU
    wFNCFE
    wJGSBNF
    wTUZMF
    w

    View full-size slide

  14. ஫ҙ͢΂͖ଐੑ
    wΠϕϯτϋϯυϥ PODMJDL PO

    wKBWBTDSJQUεΩʔϚ͕ॻ͚Δཁૉ
    wISFG TSD DJUF
    wTUZMF
    wޙड़

    View full-size slide

  15. ͸ͯͳμΠΞϦʔͷ944ରࡦ
    wར༻ՄೳཁૉˠϗϫΠτϦετܗࣜ
    wར༻ՄೳଐੑˠϗϫΠτϦετܗࣜ
    wಛఆͷཁૉɾଐੑˠઐ༻ͷରࡦ
    wεΩʔϜରࡦ
    wελΠϧରࡦ

    View full-size slide

  16. $44ͷ944ରࡦ
    wFYQSFTTJPOରࡦ
    w!JNQPSUରࡦ

    View full-size slide

  17. FYQSFTTJPO
    color: expression( error ? 'red' : 'blue');

    View full-size slide

  18. FYQSFTTJPOίϝϯτ
    expr/* ίϝϯτ */ession

    View full-size slide

  19. FYQSFTTJPOίʔυϙΠϯτ
    \0065xpression

    View full-size slide

  20. FYQSFTTJPOશ֯
    ̴̴̸͇̿́͂͂̾̽

    View full-size slide

  21. FYQSFTTJPO਺஋จࣈ

    View full-size slide

  22. FYQSFTTJPOҟମ
    expressio\207f
    expressioⁿ
    ˣ

    View full-size slide

  23. !JNQPSU
    w!JNQPSUઌΛల։͢Δ
    w!JNQPS!JNQP!JNQ!JN!J

    View full-size slide

  24. ϒϩάύʔπͷ944ରࡦ
    wϗϫΠτϦετܗࣜ
    wIUUQTNFUBDQBOPSHSFMFBTF
    )5.-8JEHFU7BMJEBUPS

    View full-size slide

  25. ϒϩάύʔπͷ944ରࡦ
    wϒϩάόʔπࣗ਎ʹ੬ऑੑ͕͋Δ
    wυϝΠϯࣦޮˠѱҙΛ࣋ͬͨ+4࣮ߦ

    View full-size slide

  26. 944ରࡦৄ͘͠͸
    wϔϧϓ͸ͯͳμΠΞϦʔ944ରࡦ
    wIUUQIBUFOBEJBSZHIBUFOBOFKQ
    LFZXPSE͸ͯͳμΠΞϦʔ944ରࡦ

    View full-size slide

  27. ͸ͯͳͱݴ͑͹944

    View full-size slide

  28. ͸ͯͳϒϩά
    wϦϦʔε
    wIUUQIBUFOBCMPHDPN
    wIBUFOBOFKQ͡Όͳ͍ॳͷຊαʔϏε
    w+4ϑϦʔ

    View full-size slide

  29. ϔομͷJGSBNFԽ
    iframe blog.hatena.ne.jp
    onishi.hatenablog.com

    View full-size slide

  30. ͦͷ৔ฤू

    View full-size slide

  31. ͦͷ৔ฤू

    View full-size slide

  32. ΫϩευϝΠϯ௨৴

    wXJOEPXQPTU.FTTBHF
    w΢Οϯυ΢ ϑϨʔϜ
    ؒͰϝοηʔδͷ
    ૹड৴Λߦ͏ͨΊͷ࢓૊Έ
    // message Πϕϯτ؂ࢹ
    window.addEventListener(“message”, function() {...},
    false);
    // message ૹ৴
    window.postMessage(data, “targetOrigin”);

    View full-size slide

  33. ΫϩευϝΠϯ௨৴

    wQPTU.FTTBHFඇରԠϒϥ΢β ݹ͍*&

    wMPDBUJPOIBTIʹΑΔυϝΠϯؒ௨৴
    wϑϨʔϜͷMPDBUJPOIBTIॻ͖׵͑
    wϑϨʔϜ಺͸MPDBUJPOIBTIͷมԽ
    Λ؂ࢹ
    w5$1෩σʔλ௨৴
    w63-௕੍ݶ *&ͰόΠτ
    ʹΑΔύ
    έοτ෼ׂ

    View full-size slide

  34. ΫϩευϝΠϯ௨৴ͷར༻
    wͦͷ৔ฤू
    wӾཡऀͷฤूݖݶ֬ೝ
    w͸ͯͳελʔ
    wίϝϯτ
    w௨஌
    wϑΟʔυόοΫϑΥʔϜ

    View full-size slide

  35. αʔυύʔςΟ$PPLJF
    wJGSBNF΍TDSJQUཁૉͰຒΊࠐ·Εͨ
    ֎෦Ϧιʔεʹ$PPLJFΛૹ৴͢Δ͔
    w'JSFGPY͔ΒσϑΥϧτ0''
    wJGSBNFʹΑΔΫϩευϝΠϯ௨৴͕࢖
    ͑ͳ͍

    View full-size slide

  36. αʔυύʔςΟ$PPLJF0''ରࡦ
    wCMPHIBUFOBOFKQυϝΠϯͷ"1*Ξ
    ΫηεDPPLJFૹ৴͋Δ͔νΣοΫ
    wJGSBNF͔ΒXJOEPXPQFOʹ͢Δ
    wϢʔβʔ৘ใ͕औΕͳ͍ͷͰ୅ସ৘
    ใΛදࣔ͢Δ

    View full-size slide

  37. ୅ସϔομ

    View full-size slide

  38. ΞΫηείϯτϩʔϧ
    wϒϩάͷ͸ϓϥΠϕʔτ
    wೝূͷ࢓૊ΈͷෳࡶԽ
    w֎෦ͷιʔγϟϧάϥϑೝূ
    wηογϣϯϋΠδϟοΫ๷ࢭ
    wϒϩάຖʹผυϝΠϯ
    wผϢʔβʔʹ࿙Εͯ΋ͳΔ΂͘໰୊ͳ͍
    wηογϣϯຖʹ%#ΞΫηε͠ͳ͍

    View full-size slide

  39. ΞΫηείϯτϩʔϧ

    ॳճΞΫηε࣌ͷΈೝূػ͕ؔ
    %#ΛҾ͘
    UPLFO෇ͰϒϩάʹϦμΠϨΫτ
    ϒϩάຖʹӾཡ༻DPPLJFΛൃߦ
    ΞΫηε࣌ʹ͸DPPLJFͷଥ౰ੑ
    ݕূͷΈ
    ೝূػؔ
    .hatena.ne.jp
    ϒϩά
    anydomain
    Ϣʔβʔ

    View full-size slide

  40. ΞΫηείϯτϩʔϧ

    ॳճΞΫηε࣌ͷΈೝূػ͕ؔ
    %#ΛҾ͘
    UPLFO෇ͰϒϩάʹϦμΠϨΫτ
    ϒϩάຖʹӾཡ༻DPPLJFΛൃߦ
    ΞΫηε࣌ʹ͸DPPLJFͷଥ౰ੑ
    ݕূͷΈ
    ೝূػؔ
    .hatena.ne.jp
    ϒϩά
    anydomain
    Ϣʔβʔ
    UPLFO

    View full-size slide

  41. ΞΫηείϯτϩʔϧ

    ॳճΞΫηε࣌ͷΈೝূػ͕ؔ
    %#ΛҾ͘
    UPLFO෇ͰϒϩάʹϦμΠϨΫτ
    ϒϩάຖʹӾཡ༻DPPLJFΛൃߦ
    ΞΫηε࣌ʹ͸DPPLJFͷଥ౰ੑ
    ݕূͷΈ
    ೝূػؔ
    .hatena.ne.jp
    ϒϩά
    anydomain
    Ϣʔβʔ
    DPPLJF

    View full-size slide

  42. ΞΫηείϯτϩʔϧ

    ॳճΞΫηε࣌ͷΈೝূػ͕ؔ
    %#ΛҾ͘
    UPLFO෇ͰϒϩάʹϦμΠϨΫτ
    ϒϩάຖʹӾཡ༻DPPLJFΛൃߦ
    ΞΫηε࣌ʹ͸DPPLJFͷଥ౰ੑ
    ݕূͷΈ
    ೝূػؔ
    .hatena.ne.jp
    ϒϩά
    anydomain
    Ϣʔβʔ

    View full-size slide

  43. ΫϦοΫδϟοΩϯάରࡦ
    w9'SBNF0QUJPOT%&/:
    wϑϨʔϜ༻ͷཁૉ͸໌ࣔతʹڐՄ
    wͦͷ৔߹ɺ*/165ཁૉͷมߋΛ؂ࢹ

    View full-size slide

  44. ΫϦοΫδϟοΩϯάରࡦ

    View full-size slide

  45. ·ͱΊ
    w͸ͯͳμΠΞϦʔ
    wIBUFOBOFKQυϝΠϯͳͷͰపఈ͠
    ͨϗϫΠτϦετରࡦ
    w͸ͯͳϒϩά
    wಠࣗυϝΠϯΫϩευϝΠϯ௨৴

    View full-size slide

  46. ਓࡐืू
    wגࣜձࣾ͸ͯͳͰ͸ΤϯδχΞͦͷଞ
    શ৬छΛืू͍ͯ͠·͢
    wҰॹʹϒϩάΛ࡞Γ·͠ΐ͏ʂ
    www.hatena.ne.jp/company/staff

    View full-size slide

  47. αϚʔΠϯλʔϯ
    w िؒ

    w8FCαʔϏε։ൃίʔε໊ఔ౓
    wେن໛γεςϜݚڀίʔε໊ఔ౓
    wۙʑืू։࢝͠·͢ʂʂ
    developer.hatenastaff.com

    View full-size slide