Javaによるセキュアコーディングの第一歩

Slide 1

Slide 1 text

@yoshitaro-yoyo 2023/01/28 参照から学ぶセキュアコーディング

Slide 2

Slide 2 text

@yoshitaro-yoyo 2023/01/28 参照から学ぶセキュアコーディング

Slide 3

Slide 3 text

ΤϯδχΞલ ೥݄d   ɹɹɹɹɹɹ   ೥݄d     ೥݄d !ZPTIJUBSPZPZP   ༀہళ௕ɾྟচ޻ֶٕ࢜ɾͤͲΓɾεΫʔϧߨࢣ   େࡕͷडୗ։ൃاۀ   େࡕͷࣗࣾ։ൃͷ4&4෦໳   ۚ୔ͷ஍ۜࢠձࣾࣗࣾ։ൃاۀ   ΤϯδχΞͷྠɾژ౎ϓϩάϥϛϯάڭࣨӡӦϝϯόʔ झຯ   μϯεɾԻָɾόΠΫɾөըɾອըখઆɾྉཧɾΞʔτFUD yoshitaro

Slide 4

Slide 4 text

ෳ੡ʮγϟϩ΢ίϐʔͱσΟʔϓίϐʔʯ ผ໊ࢀর໰୊ʹ͍ͭͯ ෆมੑʢJNNVUBCMFʣ ෆมΦϒδΣΫτͷམͱ݀͠   ɹɹσΟϑΣϯγϒίϐʔ ৴པڥք 5SVTU#PVOEBSZ   参照から学ぶセキュアコーディング

Slide 5

Slide 5 text

ෳ੡ʮγϟϩ΢ίϐʔͱσΟʔϓίϐʔʯ

Slide 6

Slide 6 text

γϟϩ΢ίϐʔ͸ࢀরͷෳ੡   σΟʔϓίϐʔ͸࣮ମͷෳ੡ ෳ੡ͷ໾ׂͱͯ͠ɺ࣮ମͷෳ੡͕ٻΊΒΕ͍ͯΔɻ

Slide 7

Slide 7 text

γϟϩ΢ίϐʔ͸ɺ ࢀর ஋ ͷڞ༗Ͱ͢ ࢀরڞ༗໰୊ͷݪҼͰ͢ɻ

Slide 8

Slide 8 text

Date retirementDate = new Date(Date.parse("Tue 1 Nov 2016")); Date partyDate = retirementDate; ϝϞϦ্Ͱ͸Կ͕ى͖͍ͯΔͷͰ͠ΐ͏͔ʁ

Slide 9

Slide 9 text

Date retirementDate = new Date(Date.parse("Tue 1 Nov 2016”)); Date partyDate = retirementDate; 、⾔⼀時保存領域、展開必要。両者違、⼤。様⼤領域扱（Java）

Slide 10

Slide 10 text

σΟʔϓίϐʔ͸ɺ ࣮ମͷෳ੡Ͱ͢ ຊདྷෳ੡ͱ͸ͪ͜ΒͷҙຯΛࢦ͢΂͖ɻ

Slide 11

Slide 11 text

Date retirementDate = new Date(Date.parse("Tue 1 Nov 2016")); Date partyDate = new Date(retirementDate.getTime()); σΟʔϓίϐʔͰ͸ɺෳ੡ݩͷ஋Λ༻͍ͯΠϯελϯεԽ Date retirementDate = new Date(Date.parse("Tue 1 Nov 2016")); Date partyDate = retirementDate; γϟϩ΢ίϐʔ͸͜Ε

Slide 12

Slide 12 text

new 演算⼦領域新展開特殊演算⼦ 1. 領域新領域確保 2. 格納値 3. 新領域参照値変数代⼊ Date retirementDate = new Date(Date.parse("Tue 1 Nov 2016")); Date partyDate = new Date(retirementDate.getTime());

Slide 13

Slide 13 text

ίϯϐϡʔλϝϞϦྖҬ͸04ͱݴޠͰγΣΞ ώʔϓྖҬʹ͸Πϯελϯε ϩʔΧϧม਺ͱ͔͸ελοΫ ෆมੑʹ΋ෳ੡ʹ΋छྨ͕͋ΓɺͦΕͧΕ۠ผ͕ॏཁ

Slide 14

Slide 14 text

ϓϦϛςΟϒܕ͸஋͕ͦͷ··ෳ੡͞ΕΔ   ɹˠελοΫྖҬ಺ʢσΟʔϓίϐʔʹࣅ͍ͯΔʣ ࢀরܕ͸ࢀরઌͷΞυϨε͕ෳ੡͞ΕΔ   ɹˠγϟϩ΢ίϐʔ     ˞4USJOHܕ͸ࢀরܕ͕ͩɺෆมΦϒδΣΫτͳͷͰ   ࠶୅ೖͷ౓ʹΠϯελϯε͕ੜ੒͞ΕΔ ࠶୅ೖ͞ΕΔσʔλͷܕ͕ ϓϦϛςΟϒܕ͔ࢀরܕ͔ʹΑͬͯڍಈ͕มΘΔ

Slide 15

Slide 15 text

Slide 16

Slide 16 text

ผ໊ࢀর໰୊ʹ͍ͭͯ

Slide 17

Slide 17 text

・⼆枚⽬ Date partyDate = retirementDate; 同参照値共有・三枚⽬ partyDate.setDate(5); 「共有状態意図変更」   Setter 様可変場合、発⽣問題「不注意」 Java・Ruby・Python・PHP 、参照複製明⽰的記述 OOP 起

Slide 18

Slide 18 text

No content

Slide 19

Slide 19 text

·ͨɺ$ͷߏ଄ମ͸ϓϦϛςΟϒܕͷͨΊɺ ෳ੡͢ΔͱৗʹผͷΠϯελϯε͕ੜ੒͞ΕΔ ͭ·Γ୅ೖ࣌ʹৗʹෳ੡͕ߦΘΕΔ

Slide 20

Slide 20 text

ผ໊ࢀর໰୊ͷຊ࣭͸ ʮڞ༗͞ΕͨΠϯελϯε͕ՄมΦϒδΣΫ τͷ৔߹ɺঢ়ଶมߋ͕ҙਤͤͣى͖͏Δʯ ͜ͱͰ͢ɻ ͔͜͜Βݟग़ͤΔղܾࡦ͸఺Ͱ͢ɻ

Slide 21

Slide 21 text

ෆมΦϒδΣΫτΛѻ͏΂͖ ୅ೖ࣌͸ৗʹෳ੡Λߦ͏΂͖ ෆมੑʹ΋ෳ੡ʹ΋छྨ͕͋ΓɺͦΕͧΕ۠ผ͕ॏཁ ෆมͰ͋Ε͹γϟϩ΢ίϐʔͰࢀর͕ڞ༗͞Εͯ΋໰୊ͳ͍ɻมߋͰ͖ͳ͍͔Βͩɻ มߋΛ๷͛ͳ͍ɾՄมΦϒδΣΫτ͔͠ѻ͑ͳ͍ͷͰ͋Ε͹ɺৗʹσΟʔϓίϐʔΛฦ͢

Slide 22

Slide 22 text

Slide 23

Slide 23 text

ෆมੑʢJNNVUBCMFʣ

Slide 24

Slide 24 text

ΦϒδΣΫτͷঢ়ଶΛมߋ͢ΔΞΫηαϝιουΛఏڙ͠ͳ͍ ܧঝͤ͞ͳ͍ʢΫϥεΛɹGJOBMɹʹ͢Δ͔ίϯετϥΫλΛɹQSJWBUFɹʹ͢Δʣ   ɹɹɹ୅ΘΓʹQVCMJDɹͰTUBUJDͳϑΝΫτϦϝιουΛఏڙ͢Δ ɹ͢΂ͯͷϑΟʔϧυΛɹGJOBMɹʹ͢Δ ɹ͢΂ͯͷϑΟʔϧυΛQSJWBUFʹ͢Δ ɹΫϥε͕อ࣋͢ΔϑΟʔϧυʹՄมΦϒδΣΫτ͕͋ͬͨ৔߹ɺ   ɹͦΕʹର͢Δಠ઎తΞΫηεΛอূ͢Δ

Slide 25

Slide 25 text

Slide 26

Slide 26 text

ෆมΦϒδΣΫτͷམͱ݀͠ σΟϑΣϯγϒίϐʔ

Slide 27

Slide 27 text

FYBNQMF FYBNQMF

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

Slide 31

Slide 31 text

৴པڥք 5SVTU#PVOEBSZ

Slide 32

Slide 32 text

ϓϩάϥϜʹҾ͔Εͨڥքઢ ɾҰํͰ͸ɺσʔλ͸৴པͰ͖ͳ͍ ɾଞํͰ͸ɺσʔλ͸৴པͰ͖Δ ͱ૝ఆ   ৴པͰ͖ͳ͍ଆ͔Βೖ͖ͬͯͨσʔλ͸ɺݕূʹύεɾ ແ֐Խ͠͸͡Ίͯɺ৴པͰ͖ΔଆʹҠ͢͜ͱ͕Ͱ͖Δɻ   ͭ·ΓϗϫΠτϦετܗࣜͰ҆શੑΛ୲อ͢Δɻ ৴པڥք 5SVTU#PVOEBSZ

Slide 33

Slide 33 text

఺ઢ͕৴པڥքઢ

Slide 34

Slide 34 text

ׂҎ্ͷιϑτ΢ΣΞηΩϡϦςΟ ໰୊͸ʮೖྗɾग़ྗʯͰൃੜ͍ͯ͠Δ ʮ৴པڥքઢ্ʯͰ๷ޚΛߦ͏ʮڥք๷ޚʯͷ֓೦͸ͱͯ΋ॏཁ

Slide 35

Slide 35 text

ೖྗͷόϦσʔγϣϯ   ৴པڥքΛӽ͑Δશͯͷσʔλ͕ೖྗͱͯ͠৴པͰ ͖Δೖྗʢଥ౰ͳೖྗʣ͔ݕূ͢Δ ग़ྗͷ׬શͳແ֐Խ   ৴པڥքΛӽ͑Δશͯͷग़ྗσʔλΛແ֐Խ͢Δ $&355PQ4FDVSF$PEJOH1SBDUJDFTͷʮҐʯͱʮҐʯ $&35͸ถΧʔωΪʔϝϩϯେֶʹઃஔ͞ΕͨίϯϐϡʔληΩϡϦςΟରࡦΛߦ͏࿝ฮͷ૊৫

Slide 36

Slide 36 text

ϓϩάϥϜʹҾ͔Εͨڥքઢ ɾҰํͰ͸ɺσʔλ͸৴པͰ͖ͳ͍ ɾଞํͰ͸ɺσʔλ͸৴པͰ͖Δ ͱ૝ఆ   ৴པͰ͖ͳ͍ଆ͔Βೖ͖ͬͯͨσʔλ͸ɺݕূʹύε ͯ͠͸͡Ίͯɺ৴པͰ͖ΔଆʹҠ͢͜ͱ͕Ͱ͖Δɻ ৴པڥք 5SVTU#PVOEBSZ

Slide 37

Slide 37 text

No content

Slide 38

Slide 38 text

Slide 39

Slide 39 text

ෳ੡ʮγϟϩ΢ίϐʔͱσΟʔϓίϐʔʯ γϟϩ΢ίϐʔ͸ࢀরͷෳ੡ɾσΟʔϓίϐʔ͸࣮ମͷෳ੡ ผ໊ࢀর໰୊ʹ͍ͭͯ ՄมΦϒδΣΫτͷࢀরڞ༗͕μϝ ෆมੑʢJNNVUBCMFʣ ࠷ۙ͸σϑΝΫτελϯμʔυ ෆมΦϒδΣΫτͷམͱ݀͠ ෆมΦϒδΣΫτʹՄมΦϒδΣΫτͷࢀরΛ౉͢ࡍ͸஫ҙ ෆมΦϒδΣΫτ͕ՄมΦϒδΣΫτͷࢀরΛฦ͢ࡍ͸஫ҙ ৴པڥք 5SVTU#PVOEBSZ ͜͜Ͱ֎ͱ಺Λ੾Γ෼͚ɻ͜͜Ͱ๷ޚ͢Δɻ಺ଆ͸਎಺ͷੈք まとめ

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Slide 3

Slide 3 text

Slide 4

Slide 4 text

Slide 5

Slide 5 text

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Slide 29

Slide 29 text

Slide 30

Slide 30 text

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

Slide 37

Slide 37 text

Slide 38

Slide 38 text

Slide 39

Slide 39 text

Slide 40

Slide 40 text