roppongi.js #7向け
CarloͷRoppongi.js #7
View Slide
About me
Carloͱ• https://github.com/GoogleChromeLabs/carlo• Googleᐌ͘ ʮheadful Node app frameworkʯ
Node.js + Chromium• CarloChromiumΛը໘ඳըΤϯδϯͱͯ͠ಈ࡞͢ΔNode.js ΞϓϦέʔγϣϯϑϨʔϜϫʔΫ• Node.jsɺChromiumͱʹV8͕ಈ࡞͢ΔͨΊɺJavaScriptͷΈͰσεΫτοϓΞϓϦ͕࡞ΕΔ
͍ํ
Demohttps://github.com/Quramy/carlo-git-graph
ElectronNW.jsͱͷҧ͍
ϥϯλΠϜϑΝΠϧαΠζ• Electron / NW.jsChromiumͷϨϯμϥϓϩηε͔ΒNode.jsΞΫηεͰ͖ΔΑ͏ʹͨ͠ɺಠࣗͷϥϯλΠϜΛඞཁͱ͢Δ• ͍͕ͭ͜૬ॏ͍ͨ
(ࢀߟ) ElectronͷϑΝΠϧαΠζhttps://github.com/electron/electron/releases/tag/v3.0.8
ElectronNw.jsͷ• Electron / NW.jsͰ࡞ͨ͠ΞϓϦέʔγϣϯΛ͢Δ߹ɺಠࣗϥϯλΠϜࣗମbundleͯ͢͠Δͷ͕Ұൠతɻ (Ϣʔβʔී௨ɺElectron NW.jsΛࣄલʹΠϯετʔϧͯ͠ͳ͍)• ඞવతʹͷαΠζ͕ڊେԽ͢Δ
CarloͰ࡞ͬͨΞϓϦͷ• CarloϢʔβʔ͕Πϯετʔϧ͍ͯ͠ΔChromeΛͦͷ··ར༻͢Δ• Node.jsΛطʹΠϯετʔϧ͍ͯ͠ΔϢʔβʔ͢ΔͷͰ͋ΕɺNPMͰे
CarloͰ࡞ͬͨΞϓϦͷ• Node.js͚ͩΛόϯυϧͯ͢͠Δ߹ɺhttps://github.com/zeit/pkg Λར༻͢ΔͱΑ͍Β͍͠
nodeIntegration• ElectronͰσϑΥϧτͰ nodeIntegrationͱ͍͏ػೳ͕onʹ͞Ε͍ͯΔ• ͜ΕɺϨϯμϥϓϩηε(ཁ͢Δʹը໘)͔ΒɺNode.jsͷAPIΛ৮ΕΔɺͱ͍͏ػೳ
nodeIntegration• ը໘͔ΒNode.jsʹ৮ΕΔͱ͍͏͜ͱ ͱ͔͕ී௨ʹಈ͍ͯ͠·͏• ΞϓϦέʔγϣϯʹXSSͷ੬ऑੑΛຒΊࠐΜͩͱ͖ͷඃ͕௨ৗͷWebΞϓϦͷൺ͡Όͳ͍require('child_process').execSync('ls')
nodeIntegration• CarloͰɺࣗͰબͨ͠Node.jsͷؔͷΈ͕ɺ໌ࣔతʹChromiumଆެ։͞ΕΔํࣜ• XSS͕͋ͬͨͱ͜ΖͰɺElectron΄ͲͷඃʹͳΒͳ͍ͣ
CarloͱPuppeteer
CarloͱPuppeteer• CarloPuppeteerͰChromiumΛNode.js͔Βૢ࡞͍ͯ͠Δ• Puppeteerͱ• ͜ΕGoogleͷϥΠϒϥϦ• ChromiumΛࣗಈԽ͢ΔతͰ࡞ΒΕ͍ͯΔ• Chrome Devtool ProtocolͷΫϥΠΞϯτ
CarloͱPuppeteer• NPMͷpuppeteerύοέʔδɺChromiumͷϥϯλΠϜΛpost installͰϩʔΧϧʹΠϯετʔϧͯ͘͠Δ• ૢ࡞෦ͷΈΛΓग़ͨ͠puppeteer-coreͱ͍͏ύοέʔδ͋Δɻ͍ͭ͜ϩʔΧϧΠϯετʔϧΛߦΘͳ͍ɻ Carlo͕͍ͬͯΔͷͬͪ͜
CarloͱPuppeteer• ࣮ࡍͷͱ͜Ζɺݱঢ়ͷCalroPuppeteerͷബ͍ϥούʔͰ͔͠ͳ͍• CarloͷAPIʹఆٛ͞Ε͍ͯΔ exposeFunctionͳͲPuppeteerͷಉ໊ؔʹҕৡ͍ͯ͠Δ͚ͩ
Node.js <=> Chromimum/PEFKTͷؔΛ$ISPNJVNଆ͔Βݺͼग़͠Մೳʹ͢Δ
·ͱΊ• CarloPuppeteerΛར༻ͨ͠σεΫτοϓΞϓϦΤϯδϯ• PuppeteerͷAPIͬͯΕͲ͏ͱͰͳΔ• Electron / NW.jsΑΓࣗ༝͍͕ϑΝΠϧαΠζͳͲͷ໘Ͱ༗ར• CLIʹͪΐͬͱͨ͠ը໘Λ͍ͨͤͨͱ͖ʹศར͔
Thank you!