Slide 1
Slide 1 text
ͦͷਖ਼نදݱɺҟٞ͋Γʂ
ʙ ReDoSʹ͍ͭͯ
Shu OGAWARA(@expajp)
2019/04/24 ۜ࠲Rails #8
Slide 2
Slide 2 text
ਖ਼نදݱͬͯ·͔͢ʁ
Slide 3
Slide 3 text
ϝΞυͷόϦσʔγϣϯʹ
ਖ਼نදݱΛ͍ͬͯΔਓ
Slide 4
Slide 4 text
ͦΕ͔ͯ͜͠͠ΜͳͷͰʁ
2019/04/24 4
Slide 5
Slide 5 text
ͳͦ͞͏
2019/04/24 5
Slide 6
Slide 6 text
ग़యɿχίχɾίϞϯζ
http://commons.nicovideo.jp/material/nc38409
Slide 7
Slide 7 text
͜ͷਖ਼نදݱʹɺ
੬ऑੑ͕͋Δ
Slide 8
Slide 8 text
࣮ࡍʹ͝ཡ͍ͩ͘͞
Slide 9
Slide 9 text
ςετεΫϦϓτ
2019/04/24 9
ग़యɿਖ਼نදݱͰͷϝʔϧΞυϨενΣοΫݟ͖͢ – ReDoS – yohgaki's blog
https://blog.ohgaki.net/redos-must-review-mail-address-validation
Slide 10
Slide 10 text
࣮ߦ݁Ռ
2019/04/24 10
Slide 11
Slide 11 text
ݪҼ
• ਖ਼نදݱΤϯδϯʹѱຐͷূ໌ΛΒ͍ͤͯΔ
• ʮҙͷจࣈྻʯදݱ͕ଓ͘ͱ
Ε͕Θ͔Βͳ͍ͷͰɺશύλʔϯΛௐΔ
– શύλʔϯΛௐͳ͍ͱ
Ϛον͠ͳ͍͜ͱ֬ఆͰ͖ͳ͍
– Έ߹Θ͕ͤരൃ͍ͯ͠Δ
2019/04/24 11
Slide 12
Slide 12 text
࣮ࡍʹΈ߹Θ͕ͤ
രൃ͍ͯ͠Δ༷ࢠΛ
͝ཡ͍ͩ͘͞
Slide 13
Slide 13 text
؆୯ͷͨΊ
• ݟͤΔͷ͜ͷ෦ͷνΣοΫͷΈ
2019/04/24 13
Slide 14
Slide 14 text
Έ߹Θͤരൃ
• host. ·ͰϚονͯ͠ɺ࣍
2019/04/24 14
Slide 15
Slide 15 text
Έ߹Θͤരൃ
• . (υοτ) ·ͰϚον͕ͨ͠
2019/04/24 15
Slide 16
Slide 16 text
Έ߹Θͤരൃ
• ͦͷޙΖ͕ҧ͏ͷͰΔ
2019/04/24 16
Slide 17
Slide 17 text
Έ߹Θͤരൃ
• ͬͺΓҧ͏ͷͰ1ͭΔɺΛ܁Γฦ͠
2019/04/24 17
Slide 18
Slide 18 text
Έ߹Θͤരൃ
• ͜͜·ͰΔ
2019/04/24 18
Slide 19
Slide 19 text
Έ߹Θͤരൃ
• ࠷ޙ·ͰͬͯɺͬͺΓϚον͠ͳ͍
2019/04/24 19
Slide 20
Slide 20 text
Έ߹Θͤരൃ
• * Λ0ճͱղऍͯ࣍͠ΛௐΔ
2019/04/24 20
Slide 21
Slide 21 text
Έ߹Θͤരൃ
• ͬͺΓϚον͠ͳ͍ͷͰ1ͭͣͭޙΖʹ
2019/04/24 21
Slide 22
Slide 22 text
Έ߹Θͤരൃ
• 1ݸͣͭͬͯͬͱϚον͠ͳ͍ͷ͕֬ఆ
2019/04/24 22
Slide 23
Slide 23 text
͜Ε͕ԿΛҙຯ͢Δ͔ʁ
Slide 24
Slide 24 text
ԿΛҙຯ͢Δ͔
• લ·ͰҰகͯ͠ɺ
࠷ޙͷ1จࣈ͚ͩϚον͠ͳ͍จࣈྻΛ
ϝʔϧΞυϨεཝʹ์ΓࠐΉ͚ͩͰ
DoS߈ܸ͕Ͱ͖Δ
2019/04/24 24
Slide 25
Slide 25 text
DoS߈ܸ
• ϦιʔεʹҙਤతʹաͳෛՙΛ͔͚ͨΓ
੬ऑੑΛ͍ͭͨΓ͢ΔࣄͰ
αʔϏεΛ͢Δ߈ܸख๏ͷ͜ͱ
– F5ΞλοΫͱ͔
• ਖ਼نදݱΛͬͨDoSReDoSͱݺΕΔ
2019/04/24 25
Slide 26
Slide 26 text
͞Βʹ൵͍͜͠ͱʹɺ
ϝΞυͷ͞Ͱ͚ͳ͍
Slide 27
Slide 27 text
࣮ߦ݁Ռ
2019/04/24 27
Slide 28
Slide 28 text
ϝʔϧΞυϨεͷఆٛ
• RFC1035, 5321ΑΓ
– ϝʔϧΞυϨεશମ256จࣈҎ
– Ϣʔβ໊ʢ@ͷલʣ64จࣈҎ
– υϝΠϯ255จࣈҎ
– υϝΠϯͷϥϕϧ63จࣈҎ
• test.example.com <- ྫ͑͜͜
– ଞɺ͑Δจࣈܾ·͍ͬͯΔ
2019/04/24 28
Slide 29
Slide 29 text
Ͳ͏͢ΕΑ͍ͷ͔ʁ
Slide 30
Slide 30 text
จࣈྻΛ۠ͬͯ͘͠
γϯϓϧͳਖ਼نදݱͰఆ
Slide 31
Slide 31 text
ͱ͍͑ɺ
͍͍࣮ͪͪ͢Δͷ໘
Slide 32
Slide 32 text
ͱ͍͏Θ͚Ͱ
(FNΛ࡞Γ·ͨ͠
Slide 33
Slide 33 text
reredos
2019/04/24 33
Slide 34
Slide 34 text
reredos
• ReDoSʹڧ͍ϝΞυͷόϦσʔγϣϯΛߦ͍ɺ
true/false Ͱฦ͢γϯϓϧͳgem
• ࠓޙͷ༧ఆ
– ଘࡏ͠ͳ͍TLDΛ͘
– URLʹରԠ͢Δ
• PR͓ͪͯ͠·͢
2019/04/24 34
Slide 35
Slide 35 text
·ͱΊ
• ਖ਼نදݱͰDoS߈ܸΛ͔͚Δख๏͕͋Δ
– ReDoSͱ͍͏
• ෳࡶͳਖ਼نදݱආ͚Δ͖
– ༷ΛͪΌΜͱಡΜͰɺ͍୯ҐͰνΣοΫΛ͢
Δ͜ͱΛ৺͕͚Α͏
• ϝΞυͰόϦσʔγϣϯ͔͚ΔgemΛ࡞ͬͨ
2019/04/24 35
Slide 36
Slide 36 text
ฏ͕ऴΘΔલʹରԠ͠Α͏
Slide 37
Slide 37 text
ࣗݾհ
• Shu OGAWARA (@expajp )
– ϦϯΧʔζגࣜձࣾ
– Ruby/Railsྺ2ऑ
– ग़ௗऔɺେֶਆށ
– झຯΫϥγοΫܥͷ߹এ
2019/04/24 37