[B! ruby][security] TokyoIncidentsã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

TokyoIncidents id:TokyoIncidents

rubyã¨securityã«é–¢ã™ã‚‹TokyoIncidentsã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (17)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

è‡ªåˆ†ãŒãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§ä½¿ã£ã¦ã„ã‚‹Gemã®è„†å¼±æ€§ãƒã‚§ãƒƒã‚¯ã—ã¦ã‚‹ï¼Ÿ - Qiita
è‡ªåˆ†ã®ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§Gemä½¿ã£ã¦ã¾ã™ã‹ï¼Ÿ å®šæœŸçš„ã«æ–°ã—ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒã‚ã‚‹ã‹ãƒã‚§ãƒƒã‚¯ã—ãŸã‚Šã€æ›´æ–°ã—ã¦ã„ã¾ã™ã‹ï¼Ÿ ãã®æ›´æ–°ã™ã‚‹ã‹ã©ã†ã‹ã®åŸºæº–ã¨ã—ã¦è„†å¼±æ€§ãƒã‚§ãƒƒã‚¯ã—ã¦ã„ã¾ã™ã‹ï¼Ÿ Gemfileã«ç™»éŒ²ã—ã¦ã„ã‚‹gemã‚’ç®¡ç†ã™ã‚‹(è„†å¼±æ€§ãŒã‚ã‚‹ã‹ã¨ã‹)ã®ã«ä½¿ãˆãã†ãªæƒ…å ±ã‚’ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ æ–°ã—ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒæ¥ãŸã‚‰é€šçŸ¥ã—ã¦ãã‚Œã‚‹(RSS) Githubã®RSS(https://github.com/) ä¾‹: rails https://github.com/rails/rails/releases.atom Githubã§ç®¡ç†ã•ã‚Œã¦ã„ã‚‹gemã®å ´åˆã¯ã“ã£ã¡ rubygemorgã®RSS(https://rubygems.org/) ä¾‹: rails https://rubygems.org/gems/rails/versions.atom rubygemã«ç™»éŒ²ã•ã‚Œã¦ã„ã‚‹å ´åˆã¯ã“ã£ã¡ æ–°ã—ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒã‚
TokyoIncidents 2020/08/14
ruby

rubygems

security
ãƒªãƒ³ã‚¯
Rubyã§å®‰å…¨ãªæ–‡å—åˆ—ãƒªãƒ†ãƒ©ãƒ«ã‹ã©ã†ã‹ã‚’åˆ¤åˆ¥ã—ãŸã„ - ã‹ã¿ã½ã‚ãƒ¼ã‚‹
Rails 5.2ã‹ã‚‰Rails SQL Injection Examplesã«ã‚ã‚‹ã‚ˆã†ãªSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’é˜²ãä»•çµ„ã¿ãŒå°Žå…¥ã•ã‚Œã¦ã€Post.order(params[:order])ã¿ãŸã„ãªã‚³ãƒ¼ãƒ‰ã¯å¿ƒæ¸©ã¾ã‚‹æ£è¦è¡¨ç¾ã«ã‚ˆã‚‹ãƒã‚§ãƒƒã‚¯ã‚’ãƒ‘ã‚¹ã—ãªã„ã¨å±é™ºã¨ã¿ãªã•ã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦ã€ãŠå‰ãŒå®‰å…¨ã‚„ã¨æ€ã†ã‚“ã‚„ã£ãŸã‚‰Post.order(Arel.sql(params[:order]))ã—ã‚ã£ã¦ã“ã¨ã«ãªã£ãŸ(rails/rails#27947)ã€‚ ã“ã‚Œã¯Rails 5.0ã®ã¨ãã«paramsãŒHashã®ã‚µãƒ–ã‚¯ãƒ©ã‚¹ã˜ã‚ƒãªããªã£ãŸã¨ãã«æ¯”ã¹ã‚Œã°ãƒžã‚·ã ã‘ã©ã€æ˜Žã‚‰ã‹å®‰å…¨ã‚„ã¨æ€ã£ã¦ã‚‹ãƒªãƒ†ãƒ©ãƒ«ã‚‚Railsã«å±é™ºã¨ã¿ãªã•ã‚Œã¦æ—¢å˜ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã‚ˆã£ãŸã‚‰éžå¸¸ã«ã‚ãšã‚‰ã‚ã—ã„ã€‚ãŸã¨ãˆã°Discourseã¨ã„ã†Railsã‚¢ãƒ—ãƒªã¯5.2ã«ä¸Šã’ã‚‹ã¨ãã«ã“ã‚Œã®å½±éŸ¿ã‚’ãƒ¢ãƒã«å—ã‘ã‚‹ã‚“ã‚„ã‘ã©ã£ã¦ã„ã†ãŠæ°—æŒã¡ã‚’è¡¨æ˜Žã—ã¦ã„ã¾ã™(ra
TokyoIncidents 2018/11/20
rails

ruby

security
ãƒªãƒ³ã‚¯
RubyGems.orgã®è„†å¼±æ€§ã«ã¤ã„ã¦ - Money Forward Developers Blog
ã“ã‚“ã«ã¡ã¯ã€é‡‘åã§ã™ã€‚ æ™®æ®µã¯Railsã‚’æ›¸ã„ãŸã‚Šã—ã¦ã„ã¾ã™ã€‚ ä»Šå›žã¯2016/4/6ã«ç™ºè¡¨ã•ã‚ŒãŸã€RubyGems.orgã®è„†å¼±æ€§ã«ã¤ã„ã¦ã¾ã¨ã‚ã¾ã—ãŸã€‚ è„†å¼±æ€§ã«ã¤ã„ã¦ RubyGems.org gem replacement vulnerability and mitigation ã‚’ã–ã£ã¨èªã‚“ã§ã¿ã‚‹ã¨ã€ ç‰¹å®šã®çŠ¶æ³ã§ã€RubyGems.orgã«updateã•ã‚Œã¦ã„ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã®å†…å®¹ãŒä¸æ£ã«æ›¸ãæ›ãˆã‚‰ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã£ãŸ ç‰¹å®šã®çŠ¶æ³ã¨ã¯ã€2014-6-11ã‹ã‚‰2016-4-2ã¾ã§ã®é–“ã«ç™»éŒ²ã•ã‚ŒãŸgemã®ã†ã¡ã€'blank-blank'ã®ã‚ˆã†ã«åå‰ã«'-' (dash)ãŒå…¥ã£ã¦ã„ã‚‹ã‚‚ã® ãŸã ã—2015-2-8ä»¥é™ã«ç™»éŒ²ã•ã‚ŒãŸgemã¯RubyGems.orgãŒsha256 checksumã‚’è¨ˆç®—ã—ã¦ãŠã‚Šã€ãã‚Œã¨å®Ÿéš›ã®ãƒ•ã‚¡ã‚¤ãƒ«ã®çªåˆã‚’ã—ã¦ã€æ›¸ãæ›ãˆã‚‰ã‚Œã¦ã„ãªã„ã“ã¨ã‚’ç¢ºèªãšã¿ ã¤ã¾ã‚Šã€2014-6
TokyoIncidents 2016/04/11
ï¾•ï½²ï½¸ï¾ï½¸ ã£ã¦èªã‚€ã®ã‹ï½— ã•ã™ãŒã£ã™

ruby

rubygems

security
ãƒªãƒ³ã‚¯
Rubyã§MySQLã«ç¹‹ããŸã‚ã®ruby-mysqlã¨mysql2 - ãŸã”ã‚‚ã‚Šã™ãƒ¡ãƒ¢
ã“ã®ã‚¨ãƒ³ãƒˆãƒªã¯ MySQL Casual Advent Calendar 2011 - MySQL Casual ã®10æ—¥ç›®ã®è¨˜äº‹ã§ã™ã€‚ ã“ã‚“ã°ã‚“ã¯ã€‚tagomorisã§ã™ã€‚ã•ã¨ã—ã§ã™ã€‚ã‚¿ã‚´ãƒ¢ãƒªã‚¹ã® s ã¯ã•ã¨ã—ã® s ã§ã™(å®Ÿè©±)ã€‚Twitterã§ #ã•ã¨ã— ã¨ã„ã†ãƒãƒƒã‚·ãƒ¥ã‚¿ã‚°ãŒæµã‚Œã‚‹ãŸã³ã€ã²ãã‹ã«ã³ãã£ã¨ã—ã¦ã¾ã™ã€‚ Rubyã‹ã‚‰MySQLã«ç¹‹ãã¨ãã«ã©ã†ã™ã‚‹ã®ã€ã¨ã¨ã‚Šã‚ãˆãš gem search -r mysql ã¨ã‹ã‚„ã‚‹ã¨æ€ã„ã¾ã™ã€‚ãã—ã¦å¤§é‡ã«ã‚ã‚Œã“ã‚Œå‡ºã¦ãã¦ã©ã†ã™ã‚Œã°ã„ã„ã‚“ã ï¼ ã¨ã„ã†æ°—åˆ†ã«ãªã‚‹ã¨æ€ã„ã¾ã™ã€‚ãã†ã„ã†æ°—åˆ†ã«ãªã£ãŸã“ã¨ãŒã‚ã‚‹ã®ã§ã€ç¾çŠ¶ã‚’ç°¡å˜ã«ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ ruby-mysql æ˜”ã‹ã‚‰ã®å®šç•ªã§ã™ãã€‚ä½œè€…ã¯ id:tmtms ã®ã¨ã¿ãŸã¾ã•ã²ã‚ã•ã‚“ã€‚rubygemsã¨ã‹ä½¿ã‚ã‚Œã‚‹å‰ã‹ã‚‰ Ruby/MySQL ã¨ã„ã†ãƒ©ã‚¤ãƒ–ãƒ©ãƒªåã§çŸ¥ã‚‰ã‚Œã¦ã„ã¾ã—ãŸã€‚Googleã§æ¤œç´¢ã™ã‚‹ã¨ãƒˆ
TokyoIncidents 2015/12/20
ruby

mysql

security
ãƒªãƒ³ã‚¯
Information Security Programming in Ruby
Information Security Programming in Ruby @nahi
TokyoIncidents 2015/11/08
ruby

security

openssl
ãƒªãƒ³ã‚¯
Disable SSLv3 for the server connection by nahi Â· Pull Request #19 Â· treasure-data/td-client-ruby
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
TokyoIncidents 2014/10/15
ruby

ssl

security
ãƒªãƒ³ã‚¯
YAML ã® URI ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã«ãŠã‘ã‚‹ãƒ’ãƒ¼ãƒ—ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã«ã¤ã„ã¦ (CVE-2014-2525)
Posted by hone and zzak on 29 Mar 2014 Translated by makimoto Ruby ã® YAML ãƒ‡ãƒ¼ã‚¿ã«ãŠã‘ã‚‹ URI ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã«ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼å•é¡ŒãŒã‚ã‚Šã¾ã™ã€‚ ã“ã®è„†å¼±æ€§ã¯ CVE è˜åˆ¥ç•ªå· CVE-2014-2525 ã«å‰²ã‚Šå½“ã¦ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ è©³ç´° ã‚¿ã‚°ä»˜ã YAML ã®ä¸ã§æ–‡å—åˆ—ãŒãƒ‘ãƒ¼ã‚¹ã•ã‚Œã‚‹éš›ã«ã€ç‰¹æ®Šãªæ–‡å—åˆ—ãŒãƒ’ãƒ¼ãƒ—ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã‚’å¼•ãèµ·ã“ã—ã€ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ä¾‹: YAML.load <code_from_unknown_source> å½±éŸ¿ã‚’å—ã‘ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ Ruby 1.9.3-p0 ä»¥ä¸Šã«ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã® YAML ãƒ‘ãƒ¼ã‚µã¨ã—ã¦ psych ãŒå«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ 0.1.5 ä»¥ä¸‹ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã® libyaml ã«ãƒªãƒ³ã‚¯ã•ã‚Œã¦ã„ã‚‹ã™ã¹ã¦ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã® psych ãŒå½±éŸ¿ã‚’å—ã‘ã¾ã™ã€‚ ã¾ãŸã€ä»¥ä¸‹ã®
TokyoIncidents 2014/03/30
ruby

security
ãƒªãƒ³ã‚¯
Ruby 1.8.7 ã¨ 1.9.2 ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ãŒå»¶é•·ã•ã‚Œã¾ã™
Posted by zzak on 17 Dec 2013 Translated by makimoto 2014å¹´6æœˆã¾ã§ 1.8.7 ã¨ 1.9.2 ã«å¯¾ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ‘ãƒƒãƒã®ã‚µãƒãƒ¼ãƒˆãŒè¡Œãªã‚ã‚Œã‚‹ã“ã¨ã«ãªã‚Šã¾ã—ãŸã€‚ Terence Lee (@hone02) ã¨ Zachary Scott (@_zzak) ãŒãƒ¡ãƒ³ãƒ†ãƒŠã¨ãªã‚Šã¾ã™ã€‚ 6ãƒ¶æœˆã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹æœŸé–“ã®ã‚ã¨ã€ã•ã‚‰ã«6ãƒ¶æœˆã®å»¶é•·ã®ãŸã‚ã«ã‚³ãƒŸãƒƒã‚¿ã‚’å‰²ã‚Šå½“ã¦ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã“ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã®å»¶é•·ãŒå®Ÿç¾ã—ãŸã®ã¯ Heroku ã«ã‚ˆã‚‹ã‚‚ã®ã§ã™ã€‚ è©³ç´°ã«ã¤ã„ã¦ã¯æ¬¡ã®ãƒ–ãƒã‚°è¨˜äº‹ã‚’å‚ç…§ãã ã•ã„ã€‚ A Patch in Time: Securing Ruby (è‹±èªž) å•é¡Œå ±å‘Šã®æ–¹æ³• å»¶é•·ã•ã‚ŒãŸãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹æœŸé–“ã¯ã€1.8.7 ã¨ 1.9.2 ã®ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ãƒªãƒã‚¸ãƒˆãƒªã«å¯¾ã—ã€ æˆ‘ã€…ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ‘ãƒƒãƒ ã®ã¿ ã‚’é©ç”¨ã—ã¾ã™ã€‚ æˆ‘ã€…ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
TokyoIncidents 2013/12/19
ruby

security
ãƒªãƒ³ã‚¯
Heap Overflow in Floating Point Parsing (CVE-2013-4164)
Posted by tenderlove on 22 Nov 2013 There is an overflow in floating point number parsing in Ruby. This vulnerability has been assigned the CVE identifier CVE-2013-4164. Details Any time a string is converted to a floating point value, a specially crafted string can cause a heap overflow. This can lead to a denial of service attack via segmentation faults and possibly arbitrary code execution. Any
TokyoIncidents 2013/11/22
ruby

JSON

security
ãƒªãƒ³ã‚¯
JVNDB-2013-003779 - JVN iPedia - è„†å¼±æ€§å¯¾ç–æƒ…å ±ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹
Ruby ã® lib/openssl/ssl.rb ã® OpenSSL::SSL.verify_certificate_identity é–¢æ•°ã¯ã€X.509 è¨¼æ˜Žæ›¸ã® Subject Alternative Name ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰å†…ã®ãƒ‰ãƒ¡ã‚¤ãƒ³åã«å«ã¾ã‚Œã‚‹ '\0' æ–‡å—ã‚’é©åˆ‡ã«å‡¦ç†ã—ãªã„ãŸã‚ã€ä»»æ„ã® SSL ã‚µãƒ¼ãƒã«ãªã‚Šã™ã¾ã•ã‚Œã‚‹è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚ æœ¬è„†å¼±æ€§ã¯ã€CVE-2009-2408 ã¨é–¢é€£ã™ã‚‹å•é¡Œã§ã™ã€‚
TokyoIncidents 2013/08/20
ruby

security
ãƒªãƒ³ã‚¯
æ©‹æœ¬å•†ä¼š Â» ä¿¡ç”¨å‡ºæ¥ãªã„Rubyã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®‰å…¨ã«evalã—ãŸã‹ã£ãŸ
ãŸã¶ã‚“å¤§ä¸ˆå¤«ã ã¨æ€ã†ã‚“ã ã‘ã©ãƒ¤ãƒã‹ã£ãŸã‚‰æ•™ãˆã¦ä¸‹ã•ã„ã€‚ ï¼ˆçš†æ§˜ã‹ã‚‰ã®æ¸©ã‹ã„ãƒˆãƒžãƒ›ãƒ¼ã‚¯(2)(3)ã«ã‚ˆã‚‹ã¨ã‚„ã£ã±ãƒ€ãƒ¡ãªã‚ˆã†ã§ã™ï¼‰ è¦ä»¶ â€“ ãƒ–ãƒ©ã‚¦ã‚¶ã§Rubyã®ã‚³ãƒ¼ãƒ‰æ›¸ã‹ã›ã¦ã€ã‚µãƒ¼ãƒãƒ¼ã«ä¿å˜ã—ã¦ã‚µãƒ¼ãƒãƒ¼ã§å®Ÿè¡Œã—ãŸã„ â€“ å±é™ºãªäº‹ã¯ã•ã‚ŒãŸããªã„ã€‚ãƒ•ã‚¡ã‚¤ãƒ«ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚„ã‚³ãƒžãƒ³ãƒ‰ã®å®Ÿè¡Œã€ã‚„ãŸã‚‰æ™‚é–“ã®ã‹ã‹ã‚‹å‡¦ç†ãªã© â€“ å®‰å…¨ã«å®Ÿè¡Œã§ããŸã‚‰ã‚³ãƒ¼ãƒ‰ã®è¿”ã‚Šå€¤ã‚’å–å¾—ã—ãŸã„ã€‚ã‚³ãƒ¼ãƒ‰ãŒå±é™ºã ã£ãŸã‚‰ã‚¨ãƒ©ãƒ¼ã‚’å–å¾—ã—ãŸã„ã€‚ â€“ å±é™ºãªäº‹ã•ã‚Œã¦ã‚‚ã€ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã—ã¦ã„ã‚‹ãƒ—ãƒã‚»ã‚¹ã¯çµ‚äº†ã—ãªã„ã§ã‚¨ãƒ©ãƒ¼ã‚’ãƒ–ãƒ©ã‚¦ã‚¶ã«è¿”ã—ãŸã„ã€‚ â€“ ã‚³ãƒ¼ãƒ‰ã¯Webã‚µãƒ¼ãƒãƒ¼ã¨åŒã˜ãƒ—ãƒã‚»ã‚¹ã§å®Ÿè¡Œã—ãŸã„ èª¿æŸ» ã¨ã„ã†ã“ã¨ã§èª¿ã¹ã¦ã„ãŸã‚‰safelevelã‚’ä½¿ãˆã°ã„ã„ã‚‰ã—ã„ â€“ Programming Ruby: The Pragmatic Programmer's Guide â€“ Rubyã®ã‚»ãƒ¼ãƒ•ãƒ¬ãƒ™ãƒ«4ç’°å¢ƒã¨ãã®ä½¿ã„æ–¹ â€“ ï¿¢ï¿¢æ—¥å¸¸æ—¥è¨˜ $SAFEã«0ã€œ
TokyoIncidents 2013/06/17
ãƒ–ã‚¯ãƒžå‚ç…§

ruby

security
ãƒªãƒ³ã‚¯
GitHub - github/secure_headers: Manages application of security headers with many safe defaults
SecureHeaders::Configuration.default do |config| config.cookies = { secure: true, # mark all cookies as "Secure" httponly: true, # mark all cookies as "HttpOnly" samesite: { lax: true # mark all cookies as SameSite=lax } } # Add "; preload" and submit the site to hstspreload.org for best protection. config.hsts = "max-age=#{1.week.to_i}" config.x_frame_options = "DENY" config.x_content_type_option
TokyoIncidents 2013/04/11
ruby

security
ãƒªãƒ³ã‚¯
http://blog.monoweb.info/blog/2012/02/18/ruby-secure-web-app/
See related links to what you are looking for.
TokyoIncidents 2013/02/25
ruby

security
ãƒªãƒ³ã‚¯
Blog
What We Know Our key takeaways from partnering with enterprise-level engineering teams. Details How We Ensure Success Our unique and personalized approach to help you achieve your business goals. Details Your SEI Platform Get to know your custom-designed Software Engineering Intelligence (SEI) platform. Details
TokyoIncidents 2012/06/25
ruby
ãƒªãƒ³ã‚¯
ã‚†ã†ã¡ã‚‡éŠ€è¡Œã‚‚ã‚¹ã‚¯ãƒ¬ãƒ¼ãƒ‘ãƒ¼ã‹ã‘ãŸã‚‰ã€è‰²ã€…çµ‚ã‚ã£ã¦ãŸã€‚ - ãã‚Œãƒžã‚°ã§ï¼
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®è©±ã¯ã“ã£ã¡â†’ã‚†ã†ã¡ã‚‡éŠ€è¡Œã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ç´›å¤±ã—ãŸã®ã§ã€å†ç™ºè¡Œæ‰‹ç¶šã—ãŸã‚‰ã€ã‚³ãƒ¼ãƒ’ãƒ¼å¹ã„ãŸè©±ã€‚ ã‚†ã†ã¡ã‚‡éŠ€è¡Œã®ã‚¹ã‚¯ãƒ¬ãƒ¼ãƒ‘ãƒ¼ ã‚†ã†ã¡ã‚‡éŠ€è¡Œã®ã‚¿ã‚¤ãƒ ã‚¢ã‚¦ãƒˆãŒãã¤ã„ã®ã¨ã€ã€Œãƒ›ãƒ¼ãƒ ã¸ã€ãƒœã‚¿ãƒ³ã‚’æŠ¼ã•ãªã„ã¨ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¨ãƒ©ãƒ¼ã«ãªã‚‹ã®ã§é ã«æ¥ãŸã€‚ãƒ–ãƒ©ã‚¦ã‚¶æˆ»ã‚‹ãƒœã‚¿ãƒ³ã€‚æŠ¼ã•ã›ã‚ã‚ˆã€‚ ã¡ã‚‡ã£ã¨æœ¬æ°—ã‚¹ã‚¯ãƒ¬ãƒ¼ãƒ‘ãƒ¼ã‚’æ›¸ã„ã¦ã‚„ã£ãŸã€‚ã‚¹ã‚¯ãƒ¬ãƒ¼ãƒ‘ãƒ¼ã‚’æ›¸ã„ã¦æ°—ã¥ã„ãŸã€‚ã‚†ã†ã¡ã‚‡éŠ€è¡Œã®ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã¯è‰²ã€…çµ‚ã‚ã£ã¦ãŸã€‚ï¼ˆå¾Œè¿°ï¼‰ ã‚†ã†ã¡ã‚‡éŠ€è¡Œã¯ ã‚†ã†ã¡ã‚‡éŠ€è¡Œã«ã¯ãƒã‚°ã‚¤ãƒ³ã®ãŸã‚ã«ä»¥ä¸‹ã®ï¼“ã¤ãŒå¿…è¦ã«ãªã‚‹ã€‚ ID 1234-5678-09876 åˆè¨€è‘‰ [è³ªå•,å›žç”][è³ªå•,å›žç”][è³ªå•,å›žç”] ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ ãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ä»•çµ„ã¿ã€‚ãƒœã‚¿ãƒ³æŠ¼ã—ãŸæ™‚ã«Formã«Actionã¨hidden eventã‚’å…¥ã‚Œã¦Submitã™ã‚‹ã€‚ ã“ã‚Œã ã‘ã‚ã‹ã‚Œã°ã‚ã¨ã¯ç°¡å˜ã€‚ ã‚µãƒ³ãƒ—ãƒ« require 'yucho_bank.rb' cli = YuchoBank.n
TokyoIncidents 2012/02/27
security

ruby
ãƒªãƒ³ã‚¯
http://blog.monoweb.info/article/2012021823.html
TokyoIncidents 2012/02/19
security

ruby
ãƒªãƒ³ã‚¯
XSS Vulnerability in the escaping function in Ruby on Rails
Either em ail addresses are anonymous for this group or you need the view member em ail addresses permission to view the original message XSS Vulnerability in the escaping function in Ruby on RailsThere is a vulnerability in the escaping code used by Ruby on Rails, using specially crafted malformed unicode strings an attacker can bypass the escaping code. This vulnerability has been assigned the CVE
TokyoIncidents 2011/08/23
ruby

rails

security
ãƒªãƒ³ã‚¯
1