æ£è¦è¡¨ç¾ã®è„†å¼±æ€§ (ReDoS) ã‚’ JavaScript ã§å¦ã¶å…ˆæ—¥ã€ã“ã®ã‚ˆã†ãªãƒ„イートを書ã„ãŸã¨ã“ã‚ã€ã‹ãªã‚Šã®å響ãŒã‚ã‚Šã¾ã—ãŸã€‚ JavaScript ã®æ£è¦è¡¨ç¾ã®è„†å¼±æ€§ã®ä¾‹ã§ã„ã†ã¨ã€ä¾‹ãˆã° /\s+$/ ã¯è„†å¼±æ€§ãŒã‚ã‚‹ã¨è¨€ãˆã‚‹ console.time(); /\s+$/.test(" ".repeat(65536) + "a"); console.timeEnd(); çµæ§‹æ™‚é–“ãŒã‹ã‹ã‚‹ã®ãŒã‚ã‹ã‚‹ã€‚ã§ã‚‚ /\s+$/ を見ã¦ã€Œã“ã‚Œã¯å±é™ºã ãªã€ã¨ç†è§£å‡ºæ¥ã‚‹äººã¯ãã‚“ãªã«ã„ãªã„。JavaScript ã«é™ã‚‰ãªã„ã‘ã‚Œã©ã€‚ — Takuo Kihira (@tkihira) February 17, 2022 ã“ã‚Œã¯ä¸€èˆ¬ã« ReDoS (Regular expression Denial of Service) ã¨å‘¼ã°ã‚Œã‚‹è„†å¼±æ€§ã§ã™ã€‚æ£ç¢ºã«ç†è§£ã™ã‚‹ã®ãŒé›£ã—ã„脆弱性ãªã®ã§ã€å°‘ã—解説ã—ã¦ã¿ãŸã„ã¨æ€ã„ã¾ã™ã€‚ çµè«– é•·ã„記事ã«ãªã‚‹ã®ã§ã€æœ€åˆã«ã€Œã¨ã‚Šã‚ãˆãšã“ã‚Œã ã‘知ã£
Playground | recheck
ã¯ã˜ã‚ã¦ã®æ£è¦è¡¨ç¾ã¨ãƒ™ã‚¹ãƒˆãƒ—ラクティス#9: `.*`ã‚„`.+`ãŒãƒãƒƒã‚¯ãƒˆãƒ©ãƒƒã‚¯ã§ä¸åˆ©ãªç†ç”±ï½œTechRacho by BPSæ ªå¼ä¼šç¤¾
Railsã®æ£è¦è¡¨ç¾ã§ã‚ˆã使ã‚れる \A \z ã£ã¦ä½•ï¼Ÿï¼Ÿ - Qiita
æ£è¦è¡¨ç¾ã«ã‚ˆã‚‹ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ã§ã¯ ^ 㨠$ ã§ã¯ãªã \A 㨠\z を使ãŠã†
ãŠãã‚‹ã¹ã—æ£è¦è¡¨ç¾ã€€ã€Œã‚ã‚‹æ–‡å—列をå«ã¾ãªã„è¡Œã€: 大阪ã®ã‚ªãƒƒã‚µãƒ³ã®ãƒ€ãƒ©ãƒ€ãƒ©æ—¥è¨˜
æ£è¦è¡¨ç¾ã®ç¢ºèª
æ£è¦è¡¨ç¾ãŒæ–‡å—列ã®å…ˆé ・末尾ã«ãƒžãƒƒãƒã™ã‚‹ã‹èª¿ã¹ã‚‹ (マルãƒãƒ©ã‚¤ãƒ³ãƒ¢ãƒ¼ãƒ‰å«ã‚€) - ã¿ã¡ã—ã‚‹ã¹
æ£è¦è¡¨ç¾ãƒ¡ãƒ¢
æ£è¦è¡¨ç¾ã§æ¥½ã€…ã‚³ãƒ¼ãƒ‰ç½®æ› - give IT a try
gkbr.me
{{#tags}}- {{label}}
{{/tags}}