UTF-8入門

文字コード / Unicode / UTF-8のデコード例 / UTF-8の脆弱性

Transcript

1. UTF-8ೖ໳ 2018/12/27 ΄ΖΑ͍ͯͬ͘
 @yn2011
2. ࣗݾ঺հ • SalesforceͱJavaScriptͷਓ • ࠷ۙͷझຯ͸γΣϧܳ
3. ࿩͢͜ͱ • จࣈίʔυͷجૅ • Unicode / UTF-8 ͷ֓ཁ • UTF-8 ͷΤϯίʔυ/σίʔυ • UTF-8 ͷ੬ऑੑ
4. ࿩͢͜ͱ • จࣈίʔυͷجૅ • Unicode / UTF-8 ͷ֓ཁ • UTF-8 ͷΤϯίʔυ/σίʔυ • UTF-8 ͷ੬ऑੑ
5. จࣈίʔυʁ
6. จࣈίʔυ ͱ จࣈූ߸ԽํࣜΛ
 ۠ผ͢Δ
7. จࣈίʔυʢූ߸Խจࣈू߹ʣ • ֤จࣈʹରԠ͢ΔϏοτͷ૊Έ߹ΘͤΛఆٛ • e.g. ASCII, JIS X 0208, Unicode … UnicodeͷจࣈίʔυදͷྫʢҰ෦ʣ UnicodeҰཡ 3000-3FFF / WikipediaΑΓҾ༻
8. จࣈූ߸Խํࣜ • จࣈූ߸Խํࣜ͸จࣈίʔυͷӡ༻نଇ • e.g. Unicode:UTF-8, UTF-16.. UTF-8ͷྫʢҰ෦ʣ ΦϨϯδ޻๪ ORANGE-FACTORY UTF-8ͷจࣈίʔυදΑΓҾ༻
9. WindowsͷϝϞா • ࠞཚ͢Δʢఆ൪ʣ
10. ࿩͢͜ͱ • จࣈίʔυͷجૅ • Unicode / UTF-8 ͷ֓ཁ • UTF-8 ͷΤϯίʔυ/σίʔυ • UTF-8 ͷ੬ऑੑ
11. UTF-8ʁ
12. UTF-8 • UTF-8͸Unicodeͱݺ͹ΕΔจࣈίʔυͷ
 จࣈූ߸Խํࣜͷ̍ͭ UTF-8 / Wikipedia ΑΓҾ༻
13. Unicode • ੈքதͷจࣈΛू໿ͨ͠จࣈίʔυ • ଟݴޠରԠͷίετ࡟ݮ • ओͳූ߸ԽํࣜʹUTF-8ͱUTF-16 Amazon Ϣχίʔυઓه ΑΓҾ༻
14. Unicode จࣈίʔυʮ௒ʯݚڀɹվగୈ2൛ P431ΑΓҾ༻
15. Unicode จࣈίʔυʮ௒ʯݚڀɹվగୈ2൛ P430ΑΓҾ༻
16. UTF-8 • Unicode Transformation Format-8 • 1όΠτ୯Ґೖग़ྗʢ8bitʣ • ASCII ޓ׵ • 1 ~ 6όΠτͷՄม௕ίʔυ
17. UTF-8 UTF-8 / WikipediaΑΓҾ༻
18. UTF-8 Pros/Cons • Pros • ASCII த৺ͷσʔλͷ৔߹͸΄΅ಉ͡αΠζʢASCIIޓ׵ʣ • จࣈͷछྨ͕ଟ͍ʢUnicodeʣ • Cons • ׽ࣈ΍ฏԾ໊͕ 3 όΠτ • ෆཁͳBOMΛ෇༩ग़དྷͯ͠·͏
19. Excel • Excel͸BOMͳ͠UTF-8ܗࣜͷCSVϑΝΠϧΛ Shift_JISͰղऍ͢Δ BOM͋ΓUTF-8 BOMͳ͠UTF-8ʢShift_JISͰղऍʣ
20. ࿩͢͜ͱ • จࣈίʔυͷجૅ • Unicode / UTF-8 ͷ֓ཁ • UTF-8 ͷΤϯίʔυ/σίʔυ • UTF-8 ͷ੬ऑੑ
21. UTF-8ͷσίʔυʹ௅ઓ
22. ʢྫʣ 0xCE94ʹରԠ͢ΔจࣈΛ ٻΊΔ
23. UTF-8ͷσίʔυنଇʢҰ෦ʣ • ઌ಄7Ϗοτ·Ͱنଇ͕͋Δʢলུʣ จࣈίʔυʮ௒ʯݚڀɹվగୈ2൛ P448ΑΓҾ༻
24. 0xCE94 • 0xCE = 11001110 • 110xxxxx → xxxxx = 01110 • 0x94 = 10010100 • 10yyyyyy → yyyyyy = 010100 • xxxxxyyyyyy = 01110010100 • U+0394 = Δ
25. ৑௕ͳΤϯίʔυ • 0xC0 = 11000000 • 110xxxxx → xxxxx = 00000 • 0xAF = 10101111 • 10yyyyyy → yyyyyy = 101111 • 0xxx xxyy yyyy = 0000 0010 1111 • U+2F = /
26. ࿩͢͜ͱ • จࣈίʔυͷجૅ • Unicode / UTF-8 ͷ֓ཁ • UTF-8 ͷΤϯίʔυ/σίʔυ • UTF-8 ͷ੬ऑੑ
27. σΟϨΫτϦɾτϥόʔαϧ • ҙਤ͠ͳ͍ϑΝΠϧ΁ΞΫηεͰ͖Δ੬ऑੑ • ../../../../../../../../../etc/passwd • / = 0x2FͷΈΛ൑ఆ͍ͯ͠Δͱ… • → 0xC0AF = / ͕ڐ༰͞Εͯةݥ
28. Salesforceͩͱ… • SalesforceʢApexʣͰ೚ҙͷ16ਐ਺ΛUTF-8 Ͱσίʔυ͢Δ // Apex System.debug(EncodingUtil.urlDecode('%e3%81%82', ‘utf-8'));
 // ͋
29. ٙΘ͍͠੬ऑੑͷใࠂ
30. ·ͱΊ • UTF-8͸Unicodeͱݺ͹ΕΔจࣈίʔυͷ
 จࣈූ߸Խํࣜͷ̍ͭ • ASCIIޓ׵Ͱ1~6όΠτͷՄม௕ίʔυ • BOMͱ৑௕ͳΤϯίʔυʹ஫ҙ
31. ೥຤೥࢝͸ จࣈίʔυͱաͦ͝͏