[B! Security][php] justoneplanetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

justoneplanet id:justoneplanet

Securityã¨phpã«é–¢ã™ã‚‹justoneplanetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (29)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

å®‰å…¨ãªPHPã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹2014
ç¥žæˆ¸ITãƒ•ã‚§ã‚¹ãƒ†ã‚£ãƒãƒ«è¬›æ¼” http://kobe-it-fes.org/kif2014/seminar/entry-197.html
justoneplanet 2014/10/12
CSRF

PHP

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

web

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
æ£è¦è¡¨ç¾ã«ã‚ˆã‚‹ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ã§ã¯ ^ ã¨ $ ã§ã¯ãªã \A ã¨ \z ã‚’ä½¿ãŠã†
æ£è¦è¡¨ç¾ã«ã‚ˆã‚‹ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ç‰ã§ã€å®Œå…¨ä¸€è‡´ã‚’ç¤ºã™ç›®çš„ã§ ^ ã¨ $ ã‚’ç”¨ã„ã‚‹æ–¹æ³•ãŒä¸€èˆ¬çš„ã§ã™ãŒã€æ£ã—ãã¯ \A ã¨ \z ã‚’ç”¨ã„ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚Rubyã®å ´åˆ ^ ã¨ $ ã‚’ä½¿ã£ã¦å®Œå…¨ä¸€è‡´ã®ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ã‚’è¡Œã†ã¨è„†å¼±æ€§ãŒå…¥ã‚Šã‚„ã™ã„ãƒ¯ãƒŠã¨ãªã‚Šã¾ã™ã€‚Perlã‚„PHPã®å ´åˆã¯ã€Rubyç¨‹ã§ã¯ã‚ã‚Šã¾ã›ã‚“ãŒä¸å…·åˆãŒç”Ÿã˜ã‚‹ã®ã§ \A ã¨ \z ã‚’ä½¿ã†ã‚ˆã†ã«ã—ã¾ã—ã‚‡ã†ã€‚ ã¯ã˜ã‚ã« å¤§åž£ã•ã‚“ã®ãƒ–ãƒã‚°ã‚¨ãƒ³ãƒˆãƒªã€ŒPHPerå‘ã‘ã€Ruby/Railsã®è½ã¨ã—ç©´ã€ã«ã¯ã€Rubyã®è½ã¨ã—ç©´ã¨ã—ã¦ã€å®Œå…¨ä¸€è‡´æ¤œç´¢ã®æŒ‡å®šã¨ã—ã¦ã€æ£è¦è¡¨ç¾ã® ^ ã¨ $ ã‚’æŒ‡å®šã™ã‚‹ä¾‹ãŒã€Ruby on Rails Security Guideã‹ã‚‰ã®å¼•ç”¨ã¨ã—ã¦ç´¹ä»‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ä»¥ä¸‹ã®æ£è¦è¡¨ç¾ã¯ã€XSSå¯¾ç–ã¨ã—ã¦ã€httpã‚¹ã‚ãƒ¼ãƒ ã‚ã‚‹ã„ã¯httpsã‚¹ã‚ãƒ¼ãƒ ã®URLã®ã¿ã‚’è¨±å¯ã™ã‚‹æ£è¦è¡¨ç¾ã®ã¤ã‚‚ã‚Šã§ã™ã€‚ /^https?:\/\/[^\n]+$/
justoneplanet 2014/03/04
æ£è¦è¡¨ç¾

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

PHP

ruby

perl

regex

regexp
ãƒªãƒ³ã‚¯
CakePHP 1.2.x, 1.3.x, 2.x ã® Paginate / PaginatorComponent ã« SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯èƒ½ãªè„†å¼±æ€§
CakePHP 1.2.x, 1.3.x, 2.x ã® Paginate / PaginatorComponent ã« SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯èƒ½ãªè„†å¼±æ€§ CakePHPï¼ˆ1.2.x ä»¥é™å…¨ã¦ï¼‰ã® Paginate / PaginatorComponent ã«ã¦ SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯èƒ½ãªè„†å¼±æ€§ãŒè¦‹ã¤ã‹ã‚Šã¾ã—ãŸã€‚ ã™ã§ã« cakephper ã•ã‚“ã® blog ã§ã‚‚æ³¨æ„å‹§å‘Šã•ã‚Œã¦ã„ã¾ã™ãŒã€ é€£ä¼‘ä¸ã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸæƒ…å ±ã¨ã„ã†ã“ã¨ã§è¦‹è½ã¨ã—ã¦ã„ã‚‹äººã‚‚ã„ã‚‹ã¨æ€ã†ã®ã§ã€ã“ã¡ã‚‰ã§ã‚‚ã€‚ å†…å®¹ ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã™ã‚‹ã¨ Paginate / PaginatorComponent ã«ã¦ SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãŒå¯èƒ½ã¨ãªã‚Šã¾ã™ã€‚ ç¾åœ¨ã¯å½±éŸ¿ã®å¤§ãã•ã‚’è€ƒæ…®ã—ã¦ã€å…¬å¼ã‚µã‚¤ãƒˆã§ã¯è„†å¼±æ€§ã®è©³ç´°ã¯æ˜Žã‚‰ã‹ã«ã•ã‚Œã¦ã„ã¾ã›ã‚“ãŒï¼ˆä¸€å®šæœŸé–“ã€ãƒ¦ãƒ¼ã‚¶ã®ã‚¢ãƒƒãƒ—ã‚°ãƒ¬ãƒ¼ãƒ‰ã‚’å¾…ã£ã¦å…¬é–‹ã™ã‚‹ã‚ˆã†ã§ã™ã€‚ï¼‰ã€ç§ãŒé–‹ç™ºç’°å¢ƒã§è©¦ã—ãŸã¨ã“ã‚ã€S
justoneplanet 2013/07/08
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

cake

PHP

security

cakephp
ãƒªãƒ³ã‚¯
5åˆ†ã§ã§ãã‚‹PHPã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼ Webãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã—ã¦ã¾ã™ã‹ï¼ ã‚ˆãã€ŒPHPã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãŒãƒ€ãƒ¡ã€ã¨ã‹è¨€ã‚ã‚Œã¦ã‚‹ã‚ˆãã€‚ ã§ã‚‚ãã‚Œã£ã¦ã€ã¹ã¤ã«PHPãŒæ‚ªã„ã‚“ã˜ã‚ƒãªãã¦ã€ ãŸã¶ã‚“ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨ã‹ãŒã€ã¾ã ã‚ˆãã‚ã‹ã‚‰ãªã„äººãŒå¤šã„ã ã‘ãªã‚“ã˜ã‚ƒãªã„ã‹ãªã€‚ ãŒã‚“ã°ã£ã¦å‹‰å¼·ã—ã‚ˆã†ã¨æ€ã£ã¦ã‚‚ã€ãªã‚“ã ã‹é›£ã—ã„ç†å±ˆãŒä¸¦ã‚“ã§ã„ãŸã‚Šã™ã‚‹ã—ãâ€¦ã€‚ ãªã®ã§ä»Šæ—¥ã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«ã¤ã„ã¦ã€ ã€Œã“ã‚Œã ã‘ã‚„ã£ã¨ã‘ã°ã€ã‚ã‚Šã¨å®‰å…¨ã«ãªã‚‹ã‚ˆã€ã£ã¦ã“ã¨ã‚’ã€åˆå¿ƒè€…ã‚€ã‘ã«ã€å¤§é›‘æŠŠã«æ›¸ã„ã¦ã¿ã¾ã™ï¼ ç†å±ˆãŒã‚ã‹ã‚‰ãªãã¦ã‚‚ã€æœ€åˆã¯ã‚³ãƒ”ãƒšã§ã‚‚ã€ ãªã«ã‚‚ã‚„ã‚‰ãªã„ã‚ˆã‚Šã€ã‚„ã£ãŸã»ã†ãŒãã£ã¨ãƒžã‚·ã«ãªã‚‹ï¼ 1. XSSå¯¾ç– å‹•çš„ãªã‚‚ã®ã‚’è¡¨ç¤ºã™ã‚‹ã¨ãã€å…¨éƒ¨ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚Œã°okã§ã™ï¼ (NG) ã‚ãªãŸã®åå‰ã¯ <?= $name ?> ã§ã™ãï¼ â†“ (OK) ã‚ãªãŸã®åå‰ã¯ <?= htmlspecialchars($name, ENT_QUOTES) ?>
justoneplanet 2012/02/17
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

php

security
ãƒªãƒ³ã‚¯
hashdosæ”»æ’ƒã‚’mod_securityã§é˜²å¾¡ã™ã‚‹(CentOS+yumç·¨)
ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€hashdoså¯¾ç–ã¨ã—ã¦ã®mod_securityã®å°Žå…¥ã¨è¨å®šã®æ–¹æ³•ã‚’èª¬æ˜Žã—ã¾ã™ã€‚CentOSç’°å¢ƒã§yumã«ã‚ˆã‚ŠApacheã‚’å°Žå…¥ã—ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã«å¯¾ã—ã¦ã€yumã«ã‚ˆã‚Šmod_securityã‚’å°Žå…¥ã™ã‚‹ã¨ã„ã†ã‚·ãƒŠãƒªã‚ªã§èª¬æ˜Žã—ã¾ã™ã€‚ ã¯ã˜ã‚ã«æ—¢ã«å½“ãƒ–ãƒã‚°ã§å ±å‘Šã®é€šã‚Šã€hashdosã¨å‘¼ã°ã‚Œã‚‹æ”»æ’ƒæ‰‹æ³•ãŒå…¬è¡¨ã•ã‚Œã¦ã„ã¾ã™ã€‚HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿åã«å¯¾ã™ã‚‹ãƒãƒƒã‚·ãƒ¥å€¤ã‚’æ•…æ„ã«åŒä¸€ã«ã—ãŸ(è¡çªã•ã›ãŸ)ã‚‚ã®ã‚’å¤šæ•°ï¼ˆæ•°ä¸‡ç¨‹åº¦ï¼‰é€ä¿¡ã™ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€Webã‚µãƒ¼ãƒãƒ¼ã‚’æ•°åˆ†ç¨‹åº¦éŽè² è·ã«ã§ãã‚‹ã¨ã„ã†DoSæ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚ã¾ã hashdosã«ã‚ˆã‚‹æ”»æ’ƒäº‹ä¾‹ã¯å ±å‘Šã•ã‚Œã¦ã„ãªã„ã‚ˆã†ã§ã™ãŒã€æ—¢ã«æ”»æ’ƒã‚³ãƒ¼ãƒ‰ï¼ˆPoCï¼‰ãŒå…¬è¡¨ã•ã‚Œã¦ã„ã‚‹ãŸã‚ã€ã„ã¤æ”»æ’ƒãŒèµ·ã“ã£ã¦ã‚‚ä¸æ€è°ã§ã¯ãªã„çŠ¶æ³ã§ã™ã€‚ PHPã‚‚å½±éŸ¿ã‚’å—ã‘ã‚‹ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã§ã‚ã‚Šã€PHP5.3.9ã§å¯¾å‡¦äºˆå®šã¨ãªã£ã¦ã„ã¾ã™ãŒã€ã¾ã PHP5.3.9ã¯ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦
justoneplanet 2012/01/09
security

Apache

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

mod_security

hashdos

php

centos

waf

yum
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å¯¾ã™ã‚‹åºƒç¯„ãªDoSæ”»æ’ƒæ‰‹æ³•(hashdos)ã®å½±éŸ¿ã¨å¯¾ç–
28C3(28th Chaos Communication Congress)ã«ãŠã„ã¦ã€Effective Denial of Service attacks against web application platformsï¼ˆWebãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã«å¯¾ã™ã‚‹åŠ¹æžœçš„ãªã‚µãƒ¼ãƒ“ã‚¹å¦¨å®³æ”»æ’ƒï¼‰ã¨é¡Œã™ã‚‹ç™ºè¡¨ãŒã‚ã‚Šã¾ã—ãŸï¼ˆã‚¿ã‚¤ãƒ ã‚¹ã‚±ã‚¸ãƒ¥ãƒ¼ãƒ«ã€è¬›æ¼”ã‚¹ãƒ©ã‚¤ãƒ‰ï¼‰ã€‚ ã“ã‚Œã«ã‚ˆã‚‹ã¨ã€PHPã‚’ã¯ã˜ã‚ã¨ã™ã‚‹å¤šãã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã«å¯¾ã—ã¦ã€CPUè³‡æºã‚’æž¯æ¸‡ã•ã›ã‚‹ã‚µãƒ¼ãƒ“ã‚¹å¦¨å®³æ”»æ’ƒ(DoSæ”»æ’ƒ)ãŒå¯èƒ½ãªæ‰‹æ³•ãŒè¦‹ã¤ã‹ã£ãŸã¨ã„ã†ã“ã¨ã§ã™ã€‚ã“ã®æ”»æ’ƒã¯ã€hashdos ã¨å‘¼ã°ã‚Œã¦ã„ã¾ã™ã€‚ æ¦‚è¦PHPãªã©å¤šãã®è¨€èªžã§ã¯ã€æ–‡å—åˆ—ã‚’ã‚ãƒ¼ã¨ã™ã‚‹é…åˆ—ï¼ˆé€£æƒ³é…åˆ—ã€ãƒãƒƒã‚·ãƒ¥ï¼‰ãŒç”¨æ„ã•ã‚Œã¦ãŠã‚Šã€HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚‚é€£æƒ³é…åˆ—ã®å½¢ã§æä¾›ã•ã‚Œã¾ã™ã€‚PHPã®å ´åˆã€$_GETã€$_POSTãªã©ã§ã™ã€‚ é€£æƒ³é…åˆ—ã®å®Ÿè£…ã«ã¯
justoneplanet 2011/12/31
dos

CPU

security

php

hashdos

post
ãƒªãƒ³ã‚¯
ç¬¬44å›žã€€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ãŒç¢ºå®Ÿã«å®Ÿæ–½ã•ã‚Œãªã„2ã¤ã®ç†ç”± | gihyo.jp
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã¯è¨€èªžã‚„ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’å•ã‚ãšéžå¸¸ã«é‡è¦ã§ã™ã€‚ã—ã‹ã—ã€å–ã‚‹ã¹ãã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ãŒç¢ºå®Ÿã«å®Ÿæ–½ã•ã‚Œãªã„ã‚±ãƒ¼ã‚¹ãŒåºƒãè¦‹å—ã‘ã‚‰ã‚Œã¾ã™ã€‚ æœ€è¿‘ã®ä¾‹ã§ã¯æ¬¡ã®ã‚ˆã†ãªç‰©ãŒã‚ã‚Šã¾ã™ã€‚ WordPress Meenews 5.1 Cross Site Scripting WordPress Enable-Latex Remote File Inclusion Dolibarr 3.1.0 RC Cross Site Scripting / SQL Injection ä¸Šã®URLã®è„†å¼±æ€§ã‚‚å¯¾ç–ãŒç°¡å˜ãªã‚‚ã®ãŒå¤šã„ã§ã™ãŒã€å¯¾ç–ãŒç°¡å˜ãªSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚‚æ•°å¤šãè¦‹ã¤ã‹ã£ã¦ã„ã¾ã™ã€‚ CMS Balit bang 3.x SQL Injection AdaptCMS 2.x SQL Injection Icomex CMS SQL Injection ãªãœç°¡å˜ãªå¯¾ç–ã§é˜²ã’ã‚‹è„†å¼±æ€§ã§ã‚‚ã‚»ã‚ãƒ¥ãƒªãƒ†
justoneplanet 2011/12/01
PHP

security
ãƒªãƒ³ã‚¯
ç¬¬5å›žã€€ãƒ•ã‚¡ã‚¤ãƒ«åã«NULLã‚’å«ã‚€å ´åˆã«ç„¡åŠ¹åŒ–ã™ã‚‹ãƒ‘ãƒƒãƒ | gihyo.jp
å‡ºåŠ›å…ˆã§ç‰¹æ®Šãªæ„å‘³ã‚’æŒã¤æ–‡å—ãŒã‚ã‚‹å ´åˆã€æ£ã—ãå‡ºåŠ›ã—ãªã„ã¨æ„å›³ã—ãªã„å‹•ä½œã‚’èµ·ã“ã™ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ä¸€ã¤ä»¥ä¸Šã®ç‰¹æ®Šãªæ„å‘³ã‚’æŒã¤æ–‡å—ãŒã‚ã‚‹å ´åˆã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã‚’ã™ã‚‹ã‹ã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã‚’ã—ãªãã¦ã‚‚å®‰å…¨ã«å‡ºåŠ›ã§ãã‚‹æ–¹æ³•ã§å‡ºåŠ›ã—ãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“ã€‚NULLæ–‡å—ã®æŒ¿å…¥ã¯Javascriptã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚„SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¨ã€ŒåŒã˜ã€ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒã§ã™ã€‚ PHP 5.3.4ã®NULLç„¡åŠ¹åŒ–ãƒ‘ãƒƒãƒ Zendã‚¨ãƒ³ã‚¸ãƒ³å´ã¯zend_vm_execute.hã®ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLERã€ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLERã€ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLERã€ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLERã«ä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ãŒè¿½åŠ ã•ã‚Œã¦ã„ã¾ã™ã€‚ + if
justoneplanet 2011/09/09
PHP

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
PDOã«ãŠã‘ã‚‹ä¸€å¿œã®å®‰å…¨å®£è¨€ã¨æ®‹ã‚‹å•é¡Œç‚¹
8æœˆ18æ—¥ã«PHP5.3.7ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚ã“ã®ãƒªãƒªãƒ¼ã‚¹ã«ã‚ˆã‚Šã€PDOã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å•é¡ŒãŒä¸€å¿œè§£æ±ºã•ã‚ŒãŸã¨åˆ¤æ–ã—ã¾ã—ãŸã®ã§ã€ã“ã“ã«ã€Œä¸€å¿œã®å®‰å…¨å®£è¨€ã€ã‚’è¡¨æ˜Žã™ã‚‹ã¨ã¨ã‚‚ã«ã€æ®‹ã‚‹å•é¡Œã«ã¤ã„ã¦å ±å‘Šã—ã¾ã™ã€‚ PDOã®å•é¡Œã¨ã¯ä½•ã‹ ä»¥å‰ã€ã¼ããŒPDOã‚’æŽ¡ç”¨ã—ãªã‹ã£ãŸã‚ã‘(Shift_JISã«ã‚ˆã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³)ã«ã¦å ±å‘Šã—ãŸã‚ˆã†ã«ã€PHP5.3.5ä»¥å‰ã®PDOã«ã¯DBæŽ¥ç¶šæ™‚ã«æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’æŒ‡å®šã™ã‚‹æ©Ÿèƒ½ãŒãªã„ãŸã‚ã€æ–‡å—åˆ—ãƒªãƒ†ãƒ©ãƒ«ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®éš›ã«æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’Latin1ã‚’ä»®å®šã—ã¦ã—ã¾ã†ã¨ã„ã†å•é¡ŒãŒã‚ã‚Šã¾ã—ãŸã€‚ã“ã®çŠ¶æ…‹ã§ã™ã¨ã€DBã«Shift_JISã§æŽ¥ç¶šã—ã¦ã„ã‚‹éš›ã«ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ãŒæ··å…¥ã—ã¾ã—ãŸã€‚ â€» å®Ÿã¯ã€å…ˆã®ã‚¨ãƒ³ãƒˆãƒªã®ã€Œè¿½è¨˜(2010/07/01 22:20)ã€ã«ç´¹ä»‹ã—ãŸæ–¹æ³•ã§æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’æŒ‡å®šã§ãã‚‹ã®ã§ã™ãŒã€ã»ã¨ã‚“ã©çŸ¥ã‚‰ã‚Œã¦ã„ãªã„ã®ã¨
justoneplanet 2011/08/24
mysql

charset

PDO

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

php
ãƒªãƒ³ã‚¯
ã¼ããŒPDOã‚’æŽ¡ç”¨ã—ãªã‹ã£ãŸã‚ã‘(Shift_JISã«ã‚ˆã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³)
è£œè¶³ ã“ã®è¨˜äº‹ã¯æ—§å¾³ä¸¸æµ©ã®æ—¥è¨˜ã‹ã‚‰ã®è»¢è¼‰ã§ã™ã€‚å…ƒURLã€ã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯1ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯2ã€‚ å‚™å¿˜ã®ãŸã‚è»¢è¼‰ã„ãŸã—ã¾ã™ãŒã€ã“ã®è¨˜äº‹ã¯2010å¹´7æœˆ1æ—¥ã«å…¬é–‹ã•ã‚ŒãŸã‚‚ã®ã§ã€å½“æ™‚ã®å¾³ä¸¸ã®è€ƒãˆã‚’ç¤ºã™ã‚‚ã®ã‚’ã€åŸºæœ¬çš„ã«å†…å®¹ã‚’å¤‰æ›´ã›ãšã«ãã®ã¾ã¾è»¢è¼‰ã™ã‚‹ã‚‚ã®ã§ã™ã€‚ è£œè¶³çµ‚ã‚ã‚Š PHPã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãƒ»ã‚¢ã‚¯ã‚»ã‚¹ãƒ»ãƒ©ã‚¤ãƒ–ãƒ©ãƒªPDOã¯ã€DBæŽ¥ç¶šæ™‚ã®æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°æŒ‡å®šãŒã§ããªã„ãŸã‚ã€æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®é¸æŠžã«ã‚ˆã£ã¦ã¯ã€ãƒ—ãƒ¬ãƒ¼ã‚¹ãƒ›ãƒ«ãƒ€ã‚’ä½¿ã£ã¦ã„ã¦ã‚‚SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ãŒç™ºç”Ÿã—ã¾ã™ã€‚ è¿½è¨˜(2011/06/19) ã“ã“ã«æ¥ã¦æ€¥ã«ãƒ–ã‚¯ãƒžãŒè¿½åŠ ã•ã‚Œã¯ã˜ã‚ã¦ã„ã¾ã™ãŒã€ã“ã®ã‚¨ãƒ³ãƒˆãƒªã‚’æ›¸ã„ã¦ã‹ã‚‰çŠ¶æ³ãŒæ”¹å–„ã—ã¦ã„ã¾ã™ã€‚PHP5.3.6(2011/03/17)ã«ã¦ã€PDOã§ã‚‚ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹æŽ¥ç¶šã®æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’æŒ‡å®šã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ã“ã®ç‰ˆã§ã€UNIXç‰ˆã®PHPã§ã¯è§£æ±ºã—ã¾ã—ãŸãŒã€Win
justoneplanet 2011/08/24
mysql

charset

PDO

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

php
ãƒªãƒ³ã‚¯
ã‚‚ã—ã€Žã‚ˆãã‚ã‹ã‚‹PHPã®æ•™ç§‘æ›¸ã€ã®è‘—è€…ãŒå¾³ä¸¸æµ©ã®ã€Žå®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹ã€ã‚’èªã‚“ã ã‚‰ - ockeghem's blog
ãŸã«ãã¡ã¾ã“ã¨ã•ã‚“ã®æ›¸ã‹ã‚ŒãŸã€Žã‚ˆãã‚ã‹ã‚‹PHPã®æ•™ç§‘æ›¸ï¼ˆä»¥ä¸‹ã€ã€Œã‚ˆãã‚ã‹ã‚‹ã€ï¼‰ã€ã‚’è³¼å…¥ã—ã¦ãƒ‘ãƒ©ãƒ‘ãƒ©ã¨è¦‹ã¦ã„ãŸã‚‰ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡ŒãŒã‹ãªã‚Šã‚ã‚‹ã“ã¨ã«æ°—ãŒã¤ãã¾ã—ãŸã€‚ãã“ã§ã€æ‹™è‘—ã€Œä½“ç³»çš„ã«å¦ã¶ å®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹ï¼ˆä»¥ä¸‹ã€å¾³ä¸¸æœ¬ï¼‰ã€ã®ç« ãƒ»ç¯€æ¯Žã«ç…§ã‚‰ã—åˆã‚ã›ã¦ã€ã€Œã‚ˆãã‚ã‹ã‚‹ã€ã®è„†å¼±æ€§ã«ã¤ã„ã¦å ±å‘Šã—ã¾ã™ã€‚ä¸»ã«ã€å¾³ä¸¸æœ¬ã®4ç« ã¨5ç« ã‚’å‚ç…§ã—ã¾ã™ã€‚ 4.2 å…¥åŠ›å‡¦ç†ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã€Œã‚ˆãã‚ã‹ã‚‹ã€ã®ã‚µãƒ³ãƒ—ãƒ«ã‚„è§£èª¬ã§ã¯ã€å…¥åŠ›å€¤æ¤œè¨¼ã¯ã»ã¨ã‚“ã©ã—ã¦ã„ã¾ã›ã‚“ã€‚ã—ã‹ã—ã€å…¥åŠ›å€¤æ¤œè¨¼ã‚’ã—ã¦ã„ãªã„ã‹ã‚‰ã¨ã„ã£ã¦å³è„†å¼±ã‹ã¨ã„ã†ã¨ãã†ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚å¾³ä¸¸æœ¬ã§ã‚‚å¼·èª¿ã—ã¦ã„ã‚‹ã‚ˆã†ã«ã€å…¥åŠ›å€¤æ¤œè¨¼ã¯ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è¦ä»¶ï¼ˆä»•æ§˜ï¼‰ã«æ²¿ã£ã¦ã„ã‚‹ã“ã¨ã‚’ç¢ºèªã™ã‚‹ã‚‚ã®ã§ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ãŒç›®çš„ã§ã¯ãªã„ã‹ã‚‰ã§ã™ã€‚ ã€Œã‚ˆãã‚ã‹ã‚‹ã€ã®ä¸ã§ã€ç§ãŒè¦‹ãŸç¯„å›²ã§å”¯ä¸€ã®å…¥åŠ›å€¤æ¤œè¨¼ã¯ã€éƒµä¾¿ç•ªå·ã®ãƒã‚§ãƒƒã‚¯ã‚’ã™ã‚‹ã‚‚ã®ã§ã™ã€‚ä»¥ä¸‹ã«å¼•ç”¨ã—ã¾ã™ï¼ˆã€Œã‚ˆãã‚
justoneplanet 2011/08/23
php

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Security

ã‚ˆãã‚ã‹ã‚‹PHPã®æ•™ç§‘æ›¸
ãƒªãƒ³ã‚¯
CakePHPã§CSRFå¯¾ç–
CakePHPã§CSRFå¯¾ç–ã‚’è¡Œã†æ–¹æ³•ã§ã™ã€‚ ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã«å«ã¾ã‚Œã¦ã„ã‚‹Securityã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆã‚’ä½¿ã„ã¾ã™ã€‚ Security#requestAuth()ã«ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã‚’è¨˜è¿°ã—ã¦ãŠãã¨ã€ã‚¢ã‚¯ã‚·ãƒ§ãƒ³å®Ÿè¡Œå‰ã«æ£è¦ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‹ã©ã†ã‹ã‚’ãƒã‚§ãƒƒã‚¯ã—ã¾ã™ã€‚ãƒã‚§ãƒƒã‚¯ã®æ–¹æ³•ã¯CSRFå¯¾ç–ã§ä¸€èˆ¬çš„ãªãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒˆãƒ¼ã‚¯ãƒ³æ–¹å¼ã§ã™ã€‚ ã¾ãšController#beforeFilter()ã«ã¦ãƒã‚§ãƒƒã‚¯ã‚’è¡Œã†ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã‚’æŒ‡å®šã—ã¾ã™ã€‚ [app/controller/test_controller.php] < ?php class TestController extends AppController { var $name = 'Test'; var $components = array('Security'); function beforeFilter() { $this->Security->req
justoneplanet 2011/05/16
CakePHP

form

CSRF

Security

PHP
ãƒªãƒ³ã‚¯
ç¬¬41å›žã€€PHP 5.3.4ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šé‡è¦ãªä»•æ§˜å¤‰æ›´ | gihyo.jp
PHP 5.3.4ã®ãƒªãƒªãƒ¼ã‚¹ã¯2010å¹´12æœˆã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚ã“ã®ãƒªãƒªãƒ¼ã‚¹ã«ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šé‡è¦ãªå¤‰æ›´ãŒè¿½åŠ ã•ã‚Œã¦ã„ã¾ã™ã€‚ Paths with NULL in them (foo\0bar.txt) are now considered as invalid. (Rasmus) ãƒ‘ã‚¹ã«â€œâ foo\0bar.txtâ â€ãªã©ã®ã‚ˆã†ã«NULLãŒå«ã¾ã‚Œã‚‹å ´åˆã¯ç„¡åŠ¹ã¨ã—ã¦å‡¦ç†ã•ã‚Œã‚‹ã€ã¨PHP 5.3.4ã®ãƒªãƒªãƒ¼ã‚¹ãƒŽãƒ¼ãƒˆã«ã¯è¨˜è¼‰ã•ã‚Œã¦ã„ã¾ã™ã€‚PHPé–‹ç™ºè€…ã®é–“ã§ã‚‚ã‚ã¾ã‚Šå¤§ããªãƒ‹ãƒ¥ãƒ¼ã‚¹ã¨ã—ã¦å–ã‚Šä¸Šã’ã‚‰ã‚Œã¦ã„ãªã„ã®ã§ã€ã“ã®ä»•æ§˜å¤‰æ›´ã‚’ã”å˜çŸ¥ã§ãªã„æ–¹ã‚‚å¤šã„ã¨æ€ã„ã¾ã™ã€‚2011å¹´4æœˆç¾åœ¨ã§ã‚‚ã“ã®ä»•æ§˜å¤‰æ›´ã¯ãƒžãƒ‹ãƒ¥ã‚¢ãƒ«ã«ã¯è¨˜è¼‰ã•ã‚Œã¦ã„ã¾ã›ã‚“ã€‚ã—ã‹ã—ã€ã“ã®ä¿®æ£ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šéžå¸¸ã«é‡è¦ãªæ„å‘³ã‚’æŒã£ã¦ã„ã‚‹ã®ã§è§£èª¬ã—ã¾ã™ã€‚ ä»•æ§˜å¤‰æ›´ã®å¿…è¦æ€§ PHP æœ¬ä½“ã¯Cè¨€èªžã§è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹ãŸã‚ã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–‹ãå ´åˆã€æœ€çµ‚çš„ã«ã¯Cè¨€
justoneplanet 2011/04/23
php

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
PHPã®escapeshellcmdã®å±é™ºæ€§ - å¾³ä¸¸æµ©ã®æ—¥è¨˜
è£œè¶³ ã“ã®è¨˜äº‹ã¯æ—§å¾³ä¸¸æµ©ã®æ—¥è¨˜ã‹ã‚‰ã®è»¢è¼‰ã§ã™ï¼ˆå…ƒURLã€ã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯1ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯2ï¼‰ã€‚ å‚™å¿˜ã®ãŸã‚è»¢è¼‰ã„ãŸã—ã¾ã™ãŒã€ã“ã®è¨˜äº‹ã¯2011å¹´1æœˆ1æ—¥ã«å…¬é–‹ã•ã‚ŒãŸã‚‚ã®ã§ã€å½“æ™‚ã®å¾³ä¸¸ã®è€ƒãˆã‚’ç¤ºã™ã‚‚ã®ã‚’ã€åŸºæœ¬çš„ã«å†…å®¹ã‚’å¤‰æ›´ã›ãšã«ãã®ã¾ã¾è»¢è¼‰ã™ã‚‹ã‚‚ã®ã§ã™ã€‚ è£œè¶³çµ‚ã‚ã‚Š æœ¬ã‚’æ›¸ã„ã¦ã„ã¾ã™ã€‚åˆç¨¿ã‚’ä¸€é€šã‚Šæ›¸ãä¸Šã’ã€ç¬¬2ç¨¿ã‚’ä½œæˆä¸ã§ã™ã€‚ãã®éŽç¨‹ã§è¦‹ã¤ã‘ãŸã“ã¨ã‚’å ±å‘Šã—ã¾ã™ã€‚ PHPã®escapeshellcmdã¯ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚’ã‚¯ã‚©ãƒ¼ãƒˆã—ãªã„ã®ã§å‘¼ã³å‡ºã—å´ã§ã‚¯ã‚©ãƒ¼ãƒˆã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ãŒã€escapeshellcmdã®ä»•æ§˜ãŒã¾ãšã„ãŸã‚ã«ã€å‘¼ã³å‡ºã—å´ã§ã‚¯ã‚©ãƒ¼ãƒˆã—ã¦ã‚‚çªç ´ã§ãã‚‹ã“ã¨ãŒåˆ†ã‹ã‚Šã¾ã—ãŸã€‚ escapeshellcmdã®ä»•æ§˜ PHPã«ã¯ã‚·ã‚§ãƒ«ã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹é–¢æ•°ãŒ2ã¤ã‚ã‚Šã¾ã™ã€‚escapeshellargã¨escapeshellcmdã§ã™ã€‚escapeshellargã¯ã€ã‚¨
justoneplanet 2011/01/11
escapeshellcmd

php

ä»•æ§˜

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
escapeshellcmdã®å±é™ºãªå®Ÿä¾‹
è£œè¶³ ã“ã®è¨˜äº‹ã¯æ—§å¾³ä¸¸æµ©ã®æ—¥è¨˜ã‹ã‚‰ã®è»¢è¼‰ã§ã™ï¼ˆå…ƒURLã€ã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯1ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯2ï¼‰ã€‚ å‚™å¿˜ã®ãŸã‚è»¢è¼‰ã„ãŸã—ã¾ã™ãŒã€ã“ã®è¨˜äº‹ã¯2011å¹´1æœˆ4æ—¥ã«å…¬é–‹ã•ã‚ŒãŸã‚‚ã®ã§ã€å½“æ™‚ã®å¾³ä¸¸ã®è€ƒãˆã‚’ç¤ºã™ã‚‚ã®ã‚’ã€åŸºæœ¬çš„ã«å†…å®¹ã‚’å¤‰æ›´ã›ãšã«ãã®ã¾ã¾è»¢è¼‰ã™ã‚‹ã‚‚ã®ã§ã™ã€‚ è£œè¶³çµ‚ã‚ã‚Š å…ˆæ—¥ã®æ—¥è¨˜PHPã®escapeshellcmdã®å±é™ºæ€§ã§ã¯PHPã®escapeshellcmdé–¢æ•°ã®å±é™ºæ€§ã«ã¤ã„ã¦æŒ‡æ‘˜ã—ã¾ã—ãŸãŒã€è„†å¼±ã¨ãªã‚‹å®Ÿä¾‹ã‚’æŒ™ã’ã¦ã„ãªã‹ã£ãŸã®ã§ã€ã€Œæœ¬å½“ã«å±é™ºãªã®ã‹ã€ã¨åŠä¿¡åŠç–‘ã®æ–¹ã‚‚ãŠã‚‰ã‚Œã‚‹ã¨æ€ã„ã¾ã™ã€‚ãã“ã§ã€åŒé–¢æ•°ãŒå±é™ºã¨ãªã‚‹å®Ÿä¾‹ã‚’è€ƒãˆãŸã®ã§å ±å‘Šã—ã¾ã™ã€‚ grepã‚’ä½¿ã£ã¦ã€ã‚µãƒ¼ãƒãƒ¼å†…ã‚’æ¤œç´¢ã™ã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è€ƒãˆã¾ã™ã€‚ <?php header('Content-Type: text/html; charset=UTF-8'); ?> <html> <body><pre> <?php $k
justoneplanet 2011/01/11
escapeshellcmd

php

ä»•æ§˜

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
phpã®escapeshellcmdã®ä½™è¨ˆãªãŠä¸–è©±ã‚’ç„¡ãã™ãƒ‘ãƒƒãƒ
(Last Updated On: )å¾³ä¸¸ã•ã‚“ã®ãƒ–ãƒã‚°ã§escapeshellcmdã®ä½™è¨ˆãªãŠä¸–è©±ã®ä»¶ãŒæŒ‡æ‘˜ã•ã‚Œã¦ã„ãŸã®ã§ãƒ‘ãƒƒãƒã‚’ä½œã‚Šã¾ã—ãŸã€‚ã“ã‚Œmagic quoteã¨åŒã˜ãƒ¬ãƒ™ãƒ«ã®ä½™è¨ˆãªãŠä¸–è©±ãªã®ã§ã™ãŒæ”¾ç½®ã•ã‚Œã¦ã„ã¾ã™ã€‚å€‹äººçš„ã«ã¯ã©ã®ã‚ˆã†ãªé–¢æ•°ã«ã‚‚å…¨ã¦ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³æ¸ˆã¿ã®æ–‡å—åˆ—ã—ã‹æ¸¡ã•ãªã„ã®ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã¯ç™ºç”Ÿã—ãªã„ã®ã§ã™ãŒã€UNIXç³»OSã§ã¯ãƒšã‚¢ã¨ãªã‚‹â€ã¨â€™ã¯ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ãªã„ä»•æ§˜ã«æ°—ãŒä»˜ã„ã¦ã„ãªã„ãƒ—ãƒã‚°ãƒ©ãƒžã‚‚å¤šã„ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ å…ˆã»ã©ã€ŒUNIXç³»OSã§ã¯ã€ã¨æ›¸ãã¾ã—ãŸãŒWindowsã§ã¯ç•°ãªã‚‹å‹•ä½œã‚’ã—ã¾ã™ã€‚ã“ã®é–¢æ•°ã¯ä»•æ§˜ãŒã„ã„åŠ æ¸›ã§Windowsã®å ´åˆã¯â€ã¨â€™ã‚‚å•ç”ç„¡ç”¨ã§ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã¾ã™ã€‚ï¼ˆåŠ ãˆã¦%ã‚‚ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã¾ã™ï¼‰ã§ã™ã‹ã‚‰ã€å¾³ä¸¸ã•ã‚“ãŒæŒ‡æ‘˜ã•ã‚ŒãŸå•é¡Œã¯Windowsã‚’ä½¿ã£ã¦ã„ã‚Œã°ç™ºç”Ÿã—ã¾ã›ã‚“ã€‚UNIXç³»ã¨Windowsã§å‹•ä½œãŒç•°ãªã‚‹ã€ã¨ã„ã†åŽ„ä»‹ãªé–¢æ•°ã§ã‚‚ã‚ã‚Šã¾ã™ã€‚ï¼ˆã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
justoneplanet 2011/01/11
php

security

escapeshellcmd

cmd
ãƒªãƒ³ã‚¯
ç¬¬36å›žã€€MOPSï¼šã‚³ãƒ³ãƒ†ã‚¯ã‚¹ãƒˆã‚’æ¤œå‡ºã™ã‚‹HTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ— | gihyo.jp
ç¬¬32å›žã€€PHP ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æœˆé–“ï¼ˆMonth of PHP Sercurityï¼‰ã§ã€ŒPHP ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æœˆé–“ã€ï¼ˆMOPS - Month of PHP Securityï¼‰ã«ã¤ã„ã¦ç°¡å˜ã«ç´¹ä»‹ã—ã¾ã—ãŸã€‚ ä»Šå›žã‚‚MOPSé–¢é€£ã®è©±é¡Œã§ã™ã€‚MOPSã§ã¯PHPé–¢é€£ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è£½å“ã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£çŸ¥è˜ã®è«–æ–‡ã‚’å‹Ÿé›†ã—ã€11ã®è«–æ–‡ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ä»Šå›žã¯ã‚³ãƒ³ãƒ†ã‚¯ã‚¹ãƒˆã‚’æ¤œå‡ºã—ã¦ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ³ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ MOPS Submission 02 â€“ Context-aware HTML escaping http://www.php-security.org/2010/05/05/mops-submission-02-context-aware-html-escaping/index.html ã“ã®ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ³ã¯Nette Latteã¨å‘¼ã°ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ³ã‚’ç‹¬
justoneplanet 2010/12/31
PHP

security

programming

ã‚³ãƒ³ãƒ†ã‚¯ã‚¹ãƒˆæ¤œå‡º

ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆ
ãƒªãƒ³ã‚¯
ç¬¬40å›žã€€MOPSï¼šå®‰å…¨æ€§ã®é«˜ã„ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒãƒƒã‚·ãƒ¥ä½œæˆãƒ„ãƒ¼ãƒ« - phpass | gihyo.jp
ç¬¬32å›žã€€PHP ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æœˆé–“ï¼ˆMonth of PHP Sercurityï¼‰ã§ã€ŒPHP ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æœˆé–“ã€ï¼ˆâ MOPS - Month of PHP Securityï¼‰ã«ã¤ã„ã¦ç°¡å˜ã«ç´¹ä»‹ã—ã¾ã—ãŸã€‚ ä»Šå›žã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å®‰å…¨ã«ä¿å˜ã™ã‚‹ãƒ„ãƒ¼ãƒ«ã®ç´¹ä»‹ã§ã™ã€‚ä»Šã¾ã§æ•°å›žã«æ¸¡ã£ã¦MOPSã®æˆæžœã®ä¸€éƒ¨ã‚’ç´¹ä»‹ã—ã¦ãã¾ã—ãŸãŒã€ä»Šå›žã§æœ€å¾Œã§ã™ã€‚ MOPS Submission 10: How to manage a PHP applicationâ€™s users and passwords http://www.php-security.org/2010/05/26/mops-submission-10-how-to-manage-a-php-applications-users-and-passwords/index.html ã“ã®è«–æ–‡ã¯1ä½ã‚’å–å¾—ã—ãŸè«–æ–‡ã§ã™ã€‚Drupal 7ã§ã“ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªãŒåˆ©ç”¨ã•ã‚Œã¦ã„
justoneplanet 2010/11/24
PHP

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

password

ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰
ãƒªãƒ³ã‚¯
æ–‡å—ã‚³ãƒ¼ãƒ‰ã«èµ·å› ã™ã‚‹è„†å¼±æ€§ã¨ãã®å¯¾ç–ï¼ˆå¢—è£œç‰ˆï¼‰
ã“ã¡ã‚‰ã®ã‚¹ãƒ©ã‚¤ãƒ‰ã¯ä»¥ä¸‹ã®ã‚µã‚¤ãƒˆã«ã¦é–²è¦§ã„ãŸã ã‘ã¾ã™ã€‚ https://www.docswell.com/s/ockeghem/ZM6VNK-phpconf2021-spa-security ã‚·ãƒ³ã‚°ãƒ«ãƒšãƒ¼ã‚¸ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³(SPA)ã«ãŠã„ã¦ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚„ãƒˆãƒ¼ã‚¯ãƒ³ã®æ ¼ç´å ´æ‰€ã¯Cookieã‚ã‚‹ã„ã¯localStorageã®ã„ãšã‚ŒãŒè‰¯ã„ã®ã‹ãªã©ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®èª²é¡ŒãŒãƒãƒƒãƒˆä¸Šã§è°è«–ã•ã‚Œã¦ã„ã¾ã™ãŒã€æ®‹å¿µãªãŒã‚‰é–“é•ã£ãŸå‰æã«åŸºã¥ãã‚‚ã®ãŒå¤šã„ã‚ˆã†ã§ã™ã€‚ã“ã®ãƒˆãƒ¼ã‚¯ã§ã¯ã€SPAã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’æ§‹æˆã™ã‚‹åŸºç¤ŽæŠ€è¡“ã‚’èª¬æ˜Žã—ãŸå¾Œã€è‘—åãªãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ãªçŠ¶æ³ã¨ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æŠ€è¡“ç†è§£ã®ç¾çŠ¶ã‚’è¸ã¾ãˆã€SPAã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ç¾å®Ÿçš„ãªæ–¹æ³•ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ å‹•ç”»ã¯ã“ã¡ã‚‰ https://www.youtube.com/watch?v=pc57hw6haXk
justoneplanet 2010/11/01
æ–‡å—ã‚³ãƒ¼ãƒ‰

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

unicode

php

security
ãƒªãƒ³ã‚¯
RIPS - PHP Security Analysis
RIPS is a static code analysis tool for the automated detection of security vulnerabilities in PHP applications. It was released 2010 during the Month of PHP Security (www.php-security.org). NOTE: RIPS 0.5 development is abandoned. A complete rewrite with OOP support and higher precision is available at https://www.ripstech.com/next-generation/ Features detect XSS, SQLi, File disclosure, LFI/RFI,
justoneplanet 2010/09/27
é™çš„è§£æž

php

security

ãƒ™ãƒ³ãƒãƒžãƒ¼ã‚¯
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸