脆弱性のあるJavaScriptライブラリの使用を防ぐには / #sec_kansai 14

by Masashi Hirano

Slide 1

Slide 1 text

੬ऑੑͷ͋ΔJavaScriptϥΠϒϥϦ ͷ࢖༻Λ๷͙ʹ͸ ૯ؔ੢αΠόʔηΩϡϦςΟ̡̩େձʢୈ14ճʣ ฏ໺ ণ࢜(@shisama)

Slide 2

Slide 2 text

ฏ໺ ণ࢜ / Masashi Hirano ɹɹɹɹ Kyoto ofﬁce @shisama_ @shisama Node.js Core Collaborator ؔ੢NodeֶԂOrganizer

Slide 3

Slide 3 text

એ఻ https://nodejs.connpass.com/event/126358/

Slide 4

Slide 4 text

Agenda • JavaScriptϥΠϒϥϦͷ੬ऑੑࣄ৘ • ੬ऑੑͷ͋ΔϥΠϒϥϦͷ࢖༻Λ๷͙ʹ͸

Slide 5

Slide 5 text

JavaScriptϥΠϒϥϦͷ੬ऑੑࣄ৘

Slide 6

Slide 6 text

JavaScriptͷϥΠϒϥϦࣄ৘ • Node.js / npmͷొ৔ʹΑΓJavaScriptͷϥΠϒϥϦ͕രൃతʹ ૿͑ͨ • Node.js΍ϑϩϯτΤϯυͳͲJSͷ։ൃͰ͸ଟ͘ͷϥΠϒϥϦ͕ ࢖ΘΕ͍ͯΔ

Slide 7

Slide 7 text

npmʹొ࿥͞Ε͍ͯΔϥΠϒϥϦ͕ ѹ౗తͳ਺ʹͳ͍ͬͯΔ http://www.modulecounts.com/

Slide 8

Slide 8 text

npmʹొ࿥͞Ε͍ͯΔϥΠϒϥϦ͕ ҟৗͳ਺ʹͳ͍ͬͯΔ http://www.modulecounts.com/ ਺͕ଟ͍෼ɺ ੬ऑੑͷ͋ΔϥΠϒϥϦ΋ଟ͍

Slide 9

Slide 9 text

JavaScriptϥΠϒϥϦͷ੬ऑੑࣄ৘ • ਓؾϥΠϒϥϦʹѱҙͷ͋Δίʔυ͕ૠೖ͞ΕΔࣄ݅ • ESLint (JavaScriptͷ࠷΋ϙϐϡϥʔͳ੩తղੳπʔϧ)ʹѱҙ ͷ͋Δίʔυ͕ૠೖ͞Ε͍ͯͨ(2018೥7݄) • 1िؒʹ200ສDLͷϥΠϒϥϦevent-streamʹԾ૝௨՟΢Υ Ϩοτ͔Β҉߸伴Λ౪Έग़͢ػೳ͕ૠೖ͞ΕΔ(2018೥11݄)

Slide 10

Slide 10 text

JavaScriptϥΠϒϥϦͷ੬ऑੑࣄ৘ • ੈքͷτοϓ75,000ͷWebαΠτ(Alexaௐ΂)ͷ্Ґ37%͕Կ͔͠Βͷ ੬ऑੑͷ͋ΔJSϥΠϒϥϦΛ࢖༻ • ϊʔεΠʔελϯେֶͷݚڀνʔϜʹΑΔௐࠪ݁Ռ(2017೥) • ݹ͍ϥΠϒϥϦΛ࢖༻͍ͯ͠Δ • ޿ࠂ΍τϥοΩϯάɺιʔγϟϧϝσΟΞͷ΢ΟδΣοτʹຒΊࠐ· Ε͍ͯΔ͜ͱ͕ଟ͍

Slide 11

Slide 11 text

੬ऑੑͷ͋ΔϥΠϒϥϦͷ࢖༻Λ๷͙ʹ͸

Slide 12

Slide 12 text

npmͷηΩϡϦςΟ΁ͷऔΓ૊Έ • npmjs.comʹ֤ͯϥΠϒϥϦͷ੬ऑੑใࠂ͕Ͱ͖ΔΑ͏ʹͳ͍ͬͯΔ • npm v6͔Βnpm auditίϚϯυ͕௥Ճ͞Ε͍ͯΔ • ϓϩδΣΫτ಺ʹΠϯετʔϧͨ͠ϥΠϒϥϦͷ੬ऑੑΛνΣοΫ • ϥΠϒϥϦͷΠϯετʔϧ࣌ʹ΋࣮ߦ͞ΕΔ

Slide 13

Slide 13 text

https://www.npmjs.com/package/typescript ֤ϥΠϒϥϦͰ੬ऑੑΛใࠂՄೳ

Slide 14

Slide 14 text

npm auditΛ࣮ߦ͢ΔͱΠϯετʔϧͨ͠ ϥΠϒϥϦͷ੬ऑੑΛݕग़ͯ͘͠ΕΔ

Slide 15

Slide 15 text

npm auditΛ࢖͏ • CIͰ࣮ߦ͢Δ͜ͱͰ੬ऑੑͷ͋ΔϥΠϒϥϦͷσϓϩΠΛ๷͙ • IBM/audit-ciͱ͍͏ϥΠϒϥϦΛ࢖͑͹੬ऑੑͷϨϕϧʹԠ͡ ͨݕग़Λߦ͑Δ • npm audit ﬁxίϚϯυͰ੬ऑੑͷ͋ΔϥΠϒϥϦΛࣗಈमਖ਼

Slide 16

Slide 16 text

npm audit ﬁxΛ࣮ߦ͢Δͱ੬ऑੑ͕मਖ਼͞Εͨ όʔδϣϯͷϥΠϒϥϦΛΠϯετʔϧ͢Δ

Slide 17

Slide 17 text

npm auditͰ͸ node security projectʹใࠂ͞Ε͍ͯͳ͍ ੬ऑੑ͸ݕग़Ͱ͖ͳ͍

Slide 18

Slide 18 text

https://retirejs.github.io/retire.js/

Slide 19

Slide 19 text

Retire.jsΛ࢖͏ • CVE΍HackerOne΁ͷใࠂΛجʹ੬ऑੑΛݕग़͢Δπʔϧ • ίϚϯυϥΠϯ͚ͩͰͳ͘ɺChrome΍Firefoxͷ֦ுػೳ΋͋Δ • unpkg.comͳͲCDN͔ΒಡΈࠐΜͰ͍ΔϥΠϒϥϦ΋֬ೝ͢ Δ͜ͱ͕Ͱ͖Δ • ͋ΒΏΔWebϖʔδͷ੬ऑੑΛ֬ೝ͢Δ͜ͱ͕Ͱ͖Δ

Slide 20

Slide 20 text

Retire.jsͷChrome ExtensionͰ WikipediaΛνΣοΫ (աڈͷΩϟϓνϟͰࠓ͸طʹमਖ਼ࡁ)

Slide 21

Slide 21 text

https://snyk.io/

Slide 22

Slide 22 text

SnykΛ࢖͏ • CVEͷσʔλΛجʹ੬ऑੑͷ͋ΔϥΠϒϥϦΛνΣοΫ͢Δαʔ Ϗε • ༷ʑͳݴޠʹରԠ͍ͯ͠Δ • ੬ऑੑΛमਖ਼͢ΔPull RequestΛࣗಈੜ੒ • OSS͸ແྉͰ࢖͑Δ

Slide 23

Slide 23 text

https://snyk.io/vuln

Slide 24

Slide 24 text

·ͱΊ • JavaScript͸ϥΠϒϥϦ͕๛෋͕ͩ੬ऑੑͷ͋ΔϥΠϒϥϦ΋ଟ ͍ • ੬ऑੑͷݕग़΍म෮͸πʔϧͰߦ͑Δ

Slide 25

Slide 25 text

͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠