知られざるSerialize

Transcript

1. ஌ΒΕ͟ΔSerialize @PHP Study Cybozu Inc, Yuichi Sugiyama
2. Who am I • ਿࢁ ༞Ұ @oogFranz • αΠϘ΢ζ5೥໨ΤϯδχΞ • େاۀ޲͚άϧʔϓ΢ΣΞ Λ࡞ͬͯΔʢPHP 7.2) • ෳۀδϟζϛϡʔδγϟϯ@MASHݭָஂ
3. serialize(), unserialize()࢖ͬͯ·͔͢ʁ
4. serialize() όϦϕϯϦ $a = ["hoge", 3, true]; $a[] = &$a; echo serialize($a); # a:4:{i:0;s:4:"hoge";i:1;i:3;i:2;b:1;i:3;a:4: {i:0;s:4:"hoge";i:1;i:3;i:2;b:1;i:3;R:5;}} • PHPͷ஋Λ෮ݩՄೳͳจࣈྻʹม׵͢Δɻ • ΫϥεͷΠϯελϯεͰ͋ͬͯ΋ม׵Մೳʂ • DBʹ΋อଘͰ͖Δʂ΍ͬͨͶʂ
5. serialize() όϦϕϯϦ $a = ["hoge", 3, true]; $a[] = &$a; echo serialize($a); # a:4:{i:0;s:4:"hoge";i:1;i:3;i:2;b:1;i:3;a:4: {i:0;s:4:"hoge";i:1;i:3;i:2;b:1;i:3;R:5;}} • PHPͷ஋Λ෮ݩՄೳͳจࣈྻʹม׵͢Δɻ • ΫϥεͷΠϯελϯεͰ͋ͬͯ΋ม׵Մೳʂ • DBʹ΋อଘͰ͖Δʂ΍ͬͨͶʂ
6. Կ͕໰୊ʁ • serialize() ʹ͸࣮͸ͦΜͳʹ໰୊͸ͳ͍ • ٯؔ਺ͷunserialize()ʹ͍͔ͭ͘ͷ੬ऑੑ͕͋Δ
7. PHP Object Injection ʢPOIʣ • ҎԼͷ৚͕݅ຬͨ͞Ε͍ͯΔ৔߹ɺ։ൃऀ͕ҙਤ͍ͯ͠ͳ͍
 ίʔυΛ߈ܸऀ͕࣮ߦͰ͖Δɻ • __wakeup(), __destruct()ͳͲͷϚδοΫϝιουʹ
 ෭࡞༻ͷ͋Δίʔυ͕ॻ͔Ε͍ͯΔ • unserialize()ͷҾ਺ʹϢʔβʔ͔Βͷೖྗ͕౉͞ΕΔ
8. ϚδοΫϝιου • ಛఆͷ৚݅ͰࣗಈͰൃಈ͢Δຐ๏ • serialize()ͷ࣮ߦ࣌ʹϚδοΫϝιουͷ __sleep() ͕
 ͋ͬͨΒࣗಈͰ࣮ߦ͞ΕΔ • unserialize()࣌ʹɺϚδοΫϝιουͷ __wakeup() ͕
 ͋ͬͨΒࣗಈͰ࣮ߦ͞ΕΔ
9. αϯϓϧ class POIExample{ private $filename; public function __destruct() { unlink($this->filename); } } unserialize('O:10:"POIExample":1:{s: 20:"POIExamplefilename";s:8:"test.php";}')
10. αϯϓϧ class POIExample{ private $filename; public function __destruct() { unlink($this->filename); } } unserialize('O:10:"POIExample":1:{s: 20:"POIExamplefilename";s:8:"test.php";}') ߈ܸऀ͕೚ҙͷϑΝΠϧͷ࡟আ͕Մೳʂ
11. POIͷ͕͜͜ා͍ • ࣮ࡍʹunserializeʹ౉͞ΕΔ͜ͱ͕ͳ͍ΫϥεͰ͋ͬͯ΋ɺ
 auto_loadͷ࢓૊Έ͕͋Δͱ࣮ߦ͞Εͯ͠·͏ɻ • privateͷϝϯόม਺ʹ΋೚ҙͷ஋Λ୅ೖՄೳ
 setterΛհ͞ͳ͍ͷͰɺߟྀ͕೉͍͠ɻ • ԾʹsetterͰσΟϨΫτϦτϥόʔαϧΛ๷͍Ͱ͍ͯ΋ແҙຯ
12. • json_encode(), json_decode()Λ࢖͏ɻ
 ˠΦϒδΣΫτΛγϦΞϥΠζɾσγϦΞϥΠζ͢ΔͷͰͳ͚Ε͹ े෼ɻ • allowed_classesΦϓγϣϯΛ࢖͏
 ˠࢦఆ͞ΕͨΫϥεͷΦϒδΣΫτʹ͔͠
 ɹม׵͞Εͳ͍͜ͱ͕อূ͞ΕΔ POIΛ๷͙ʹ͸ʁ
13. allowed_classes Φϓγϣϯ $serialized_str = 'O:10:"POIExample":1:{s:20:"POIExamplefilename";s: 8:"test.php";}'; $result = unserialize($serialized_str, ['allowed_classes' => false]); var_dump($result); /* object(__PHP_Incomplete_Class)#2 (2) { ["__PHP_Incomplete_Class_Name"]=> string(10) "POIExample" ["filename":"POIExample":private]=> string(8) "test.php" } */ echo serialize($result); // O:10:"POIExample":1:{s:20:"POIExamplefilename";s:8:"test.php";}
14. allowed_classesͰकΕΔ΋ͷ • ڐՄ͞Ε͍ͯͳ͍ΫϥεΛunserialize()͢Δͱɺ__PHP_Incomplete_Class ʹม׵͞ΕΔ • ͦͷΦϒδΣΫτΛ΋͏Ұ౓serialize͢Δͱ
 ʢͳ͔ͥʣݩʹ໭Δɻ • σϑΥϧτ஋͸ true (ΨόΨό)ͳͷͰ໌ࣔతʹࢦఆ͢Δඞཁ͕͋Δ • falseΛࢦఆ͢Ε͹ɺ͋ΒΏΔΫϥεΛڋઈ͢Δ
15. __PHP_Incomplete_ClassʹͳͬͨΒΤϥʔʹ͍ͨ͠ • ةͳ͍΋ͷ͕౉͖͍ͬͯͯΔͷͰΤϥʔʹ͍ͨ͠ • get_class Λͯ͠ɺ__PHP_Incomplete_Class ͔Λௐ΂Δ • unserialize_callback_func ͸ݺͼग़͞Εͳ͍ͷͰ஫ҙɻ
16. allowed_classes͕͋Ε͹unserialize࢖ͬ ͯ΋ྑ͍ʁ https://twitter.com/nikita_ppv/status/895571304325062656
17. allowed_classes͕͋Ε͹unserialize࢖ͬ ͯ΋ྑ͍ʁ https://www.php.net/manual/ja/function.unserialize.php
18. unserializeͷ੬ऑੑ͸੬ऑੑͱΈͳ͞Εͳ͍ • ϝϞϦपΓͳͲͷෆ۩߹Ͱ͋ͬͯ΋੬ऑੑͱΈͳ͞Εͳ͍
 Մೳੑ͕͋Δ • ΧδϡΞϧʹϝϞϦपΓͷෆ۩߹͕ใࠂ͞Ε͍ͯΔ
19. serializeͨ͠஋ΛDBʹೖΕΔ͜ͱʹ͍ͭͯ • SQL Ξϯνύλʔϯͷ
 5ষ EAVʢΤϯςΟςΟɾΞτϦϏϡʔτɾόϦϡʔʣ
 ʹͳͬͯΔՄೳੑ͕ߴ͍ɻ
20. MySQLͱserialize • MySQLͷtextʹγϦΞϥΠζσʔλΛೖΕ͍ͯΔ৔߹ɺ
 จࣈ਺͕Φʔόʔ͢Δͱɺ్தͰ੾ΒΕͯ͠·͍ɺ
 ෮ݩͰ͖ͳ͘ͳΔɻʢStrict SQL Modeʹґଘʣ • MySQL 5.7͔Β͸JSONܕ͕࢖͑ΔΑ͏ʹͳͬͨͷͰɺ
 ಈతεΩʔϚ͕Ͳ͏ͯ͠΋ඞཁͳ৔߹΋JSONܕΛߟ͑ͨํ͕ Αͦ͞͏ɻ
21. ·ͱΊ • serialize(), unserialize()Λ࢖͍ͬͯͳ͍ͷͳΒɺͦΕ͕Ұ൪ • ΋͠࢖͍ͬͯΔͷͳΒɺPOIΛ๷͙ͨΊɺϢʔβʔೖྗσʔλ͕ೖͬͯ͜ͳ͍͜ͳ͍͜ͱΛ͔֬Ί Α͏ • ՄೳͰ͋Ε͹json_encode, json_decodeʹஔ͖͔͑Α͏ • ͦΕ΋ແཧͳΒɺallowed_classesΦϓγϣϯͰPOI͸͠ͷ͝͏ • DBʹ͸อଘ͠ͳ͍Α͏ʹ͠·͠ΐ͏ • ϝϞϦपΓͷෆ۩߹΋͋ΔͷͰஔ͖׵͑Λݕ౼͠·͠ΐ͏ɻ