NZKoz's rails_xss at master - GitHub
This Plugin is for rails 2.3.5, it will not work with later versions. For all later versions you should be using the rails/rails_xss version. This plugin replaces the default ERB template handlers with erubis, and switches the behaviour to escape by default rather than requiring you to escape. This is consistent with the behaviour in Rails 3.0. Strings now have a notion of "html safe", which is fa
XSS Vulnerability in Ruby on Rails
There is a vulnerability in the escaping code for the form helpers in Ruby on Rails. Attackers who can inject deliberately malformed unicode strings into the form helpers can defeat the escaping checks and inject arbitrary HTML. Versions Affected: 2.0.0 and *all* subsequent versions. Not affected: Applications running on ruby 1.9 Fixed Versions: 2.3.4, 2.2.3 Candidate CVE: CVE-2009-3009 Impact Due
CSRF防æ¢ã¨ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¿ã‚¤ãƒ アウト - 自分ã®ä»•äº‹ã‚’憎むã«ã¯äººç”Ÿã¯ä½™ã‚Šã«ã‚‚çŸã„
rails2ç³»ã¯ãˆã‚‰ã„åãªã®ã§CSRFを自動的ã«é˜²æ¢ã—ã¦ãã‚Œã¾ã™ã€‚ app/controllers/application.rbã« protect_from_forgery # :secret => 'ãªã„ã—ょ' ã¨ã‹ã„ã¨ãã ã‘ã§get以外ã®ã¨ãã«è‡ªå‹•çš„ã«ãƒˆãƒ¼ã‚¯ãƒ³ã‚’埋ã‚è¾¼ã¿ä¸æ£ãªé·ç§»ã‹ã©ã†ã‹ç¢ºèªã—ã¦ãã‚Œã¾ã™ã€‚ãªã‚“ã¨ã‚‚出æ¥ã‚‹åã§ã™ã€‚ã—ã‹ã—ã€ã“ã®æ©Ÿèƒ½ã¨ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¿ã‚¤ãƒ アウトã®è¨å®šã‚’åŒæ™‚ã«ä½¿ã†ã¨ãªã‚“ã¨ã‚‚エラーãŒç™ºç”Ÿã—ã¦ã—ã¾ã†ã€‚ ã“ã®æ©Ÿèƒ½ã¯action_controller/request_forgery_protection.rbã®ä¸ã§ã‚»ãƒƒã‚·ãƒ§ãƒ³ã®ä¸ã®ãƒ€ã‚¤ã‚¸ã‚§ã‚¹ãƒˆã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‹ã‚‰é€ã‚‰ã‚Œã¦ããŸãƒ€ã‚¤ã‚¸ã‚§ã‚¹ãƒˆãŒåŒã˜ã‹ã©ã†ã‹ã‚’判æ–ã—ã¦ã„ã‚‹ã®ã§ã™ãŒã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¿ã‚¤ãƒ アウトãŒåƒã„ã¦ã„ã‚‹ã¨ã“ã®æ™‚点ã§ã‚»ãƒƒã‚·ãƒ§ãƒ³ãŒç©ºã£ã½ã«ãªã£ã¦ã„る。ãªã®ã§CSRFエラーã¨ãªã‚ŠActionController::InvalidA
[ruby][rails] Rails-MLウォッム"Cookie session security and open-source" オープンソースã®Railsアプリケーションを使ã†æ™‚ã®æ³¨æ„äº‹é … - 本当ã¯æ€–ã„HPC
Cookie session security and open-source - Ruby on Rails: Core | Google グループ Ralisã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã®æ±šæŸ“ãƒã‚§ãƒƒã‚¯ã«ä½¿ã‚れるsecret_keyãŒã€ã‚ªãƒ¼ãƒ—ンソースã®Railsアプリケーションã«ã¨ã£ã¦ã¯è„†å¼±æ€§ã«ãªã‚‹ã®ã§ã¯ãªã„ã‹ã€ã¨ã„ã†è©±ã€‚ ãã‚Œã¯ç¢ºã‹ã«ãã†ã§ã€ã‚ªãƒ¼ãƒ—ンソースã®Ralisアプリケーションを自分ã®ã‚µãƒ¼ãƒãƒ¼ã§ç¨¼åƒã•ã›ã‚‹æ™‚ã«ã¯ã€config/environment.rb ã® config.action_controller.session = { :session_key => '_myproj_session', :secret => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' } ã¨ãªã£ã¦ã„る部分㮠:secret ã®éƒ¨åˆ†ï¼ˆä¸Šã®ä¾‹ã§ã¯ 'xxxxxxx'
![[ruby][rails] Rails-MLウォッム"Cookie session security and open-source" オープンソースã®Railsアプリケーションを使ã†æ™‚ã®æ³¨æ„äº‹é … - 本当ã¯æ€–ã„HPC](https://cdn-ak-scissors.b.st-hatena.com/image/square/8189a5fa0aab1a97d766fc030c086af7593f1b93/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F12921228815722059401%2F12921228815722059753%2F1397605031)
AJAXリクエストã§ã‚‚CSRF対ç–ã®ãƒˆãƒ¼ã‚¯ãƒ³ã‚’自動é€ä¿¡ã™ã‚‹æ–¹æ³• - Rubricks Project
å‰å›žã®ç¶šãã§ã€ã€Œrequest_forgery_protectionã€ã®å•é¡Œç‚¹ã«ã¤ã„ã¦ã€‚ GETリクエストをスルーã—ã¦ã„ã‚‹ãŸã‚æ ¹æœ¬çš„ã«CSRF対ç–ã«ãªã£ã¦ã„ãªã„ 宣言ã—ãŸã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã ã‘ã«ã—ã‹é©ç”¨ã•ã‚Œãªã„ã®ã§é–‹ç™ºè€…ã®å®£è¨€æ¼ã‚Œã®å¯èƒ½æ€§ãŒã¤ãã¾ã¨ã† FORMタグを使ã†éƒ¨åˆ†ã¯å•é¡Œãªã„ãŒã€JavaScriptã§AJAXリクエストを発行ã™ã‚‹æ™‚ã¯è‡ªå‰ã§ãƒˆãƒ¼ã‚¯ãƒ³ã‚’付ã‘åŠ ãˆã¦ã‚ã’ãªã„ã¨ã„ã‘ãªã„ ï¼’ã«é–¢ã—ã¦ã¯ã€æ‰€è¬‚ブラックリスト方å¼ã‹ãƒ›ãƒ¯ã‚¤ãƒˆãƒªã‚¹ãƒˆæ–¹å¼ã‹ã¨ã„ã£ãŸå•é¡Œã€‚ FWã¨ã—ã¦ã€ŒCSRF対ç–済ã€ã¨è¬³ã†ä»¥ä¸Šã¯ãƒ›ãƒ¯ã‚¤ãƒˆãƒªã‚¹ãƒˆå½¢å¼ã«ã™ã¹ããªã®ã§ã¯ãªã„ã‹ã¨æ€ã†ã€‚ ３ã¯çµæ§‹ãƒãƒƒãƒˆä¸Šã§ã‚‚対応方法を記載ã•ã‚Œã¦ã„ã‚‹æ–¹ãŒã¡ã‚‰ã»ã‚‰è¦‹å—ã‘られる。 具体的ã«ã©ã®ã‚ˆã†ãªå ´é¢ã§å•é¡Œã«ãªã‚‹ã‹ã¨ã„ã†ã¨ã€ JavaScriptã§ç›´æŽ¥ new Ajax.Updater() ã‚„ new Ajax.Requext()を実行 InPlaceEdit
restful_authentication login security - Ruby on Rails Security Project
There is a serious security leak in the restful_authentication plugin regarding the activation of an account. You can use it to log in w/o user credentials or impersonate someone else. The “activate†method of the controller accepts an empty activation code parameter like this (depending on your routes): http://localhost:3006/user/activate or http://localhost:3006/activate/?activation_code= Which
Ruby on Rails Security Cheatsheet - Ruby on Rails Security Project
I’m back from the Rails Conference Europe in Berlin. I realize that a 45 minute talk is hardly enough to tell everything which is important to say about Rails security. Moreover, you will never get the level right in a talk about security (or generally): There are Rails newbies, everyday-programmers and even security experts. Anyway, I was referring to this web site quite often as I wanted to prov
OBB vs AABB - Radium Software Development
iPhoneã®ä¸€èˆ¬ä¿®ç†åº—ã¯äºˆç´„ãªã—ã§ã‚‚æ¥åº—ã§ãる？ 基本的ã«ã¯é£›ã³è¾¼ã¿ã§ä¿®ç†ã«è¡Œã£ã¦ã‚‚OK iPhoneã‚’ç½®ã„ã¦ã„ãŸã‚½ãƒ•ã‚¡ã«ã†ã£ã‹ã‚Šã¨è…°ã‹ã‘ã¦ã—ã¾ã„ã€ãƒ‘ãƒãƒ«ã‚’割ã£ã¦ã—ã¾ã£ãŸã€ã“ã‚“ãªæ™‚ã¯ã‚¹ãƒžãƒ›ã®ä¸€èˆ¬ä¿®ç†åº—ã¸è¡Œãã¾ã—ょã†ã€‚ç”»é¢å‰²ã‚Œã¯ã€ã‚¹ãƒžãƒ›ã‚„タブレットã®æ•…éšœåŽŸå› ã¨ã—ã¦éžå¸¸ã«å¤šã„ã‚‚ã®ã§ã™ã€‚予約ãªã—ã§çªç„¶ãŠåº—ã«è¡Œã£ã¦ã‚‚平気ã‹ã—らã¨ã€ä¸å®‰ã«æ€ã†æ–¹ã€…ã‚‚ã„らã£ã—ゃるã‹ã‚‚ã—ã‚Œã¾ã›ã‚“。çµè«–ã¨ã—ã¦ã¯ç‰¹ã«å•é¡Œã¯ãªãã€äºˆç´„ãªã—ã§è¨ªå•ã—ã¦ã‚‚ç”»é¢å‰²ã‚Œã®ä¿®ç†ã¯ãŠé¡˜ã„ã§ãã¾ã™ã€‚ ãŸã ã—ä»–ã®ã‚µãƒ¼ãƒ“スæ¥ã®ãŠåº—åŒæ§˜ã€äºˆç´„ãªã—ã®å ´åˆã€ãŠåº—ãŒæ··é›‘ã—ã¦ã„ã‚‹ã¨é †ç•ªå¾…ã¡ã‚’ã—ãªã‘ã‚Œã°ã„ã‘ãªã„ã§ã™ã€‚特ã«ç¹ç››ã—ã¦ã„るスマホ修ç†ã®ãŠåº—ã ã¨ã€è¡Œåˆ—ãŒåº—内ã§å‡ºæ¥ã¦ãŠã‚Šã€äºˆç´„ãªã—ã ã¨ã€è‡ªåˆ†ã®é †ç•ªãŒå·¡ã£ã¦ãã‚‹ã¾ã§é•·æ™‚é–“å¾…ãŸã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚平日ã®æœã€æ˜¼ãªã‚‰åˆ©ç”¨å®¢ãŒå°‘ãªã„å ´åˆãŒå¤šãã€é£›ã³è¾¼ã¿ã§ã‚‚比較スムーズã«ä¿®ç†ãŒé ¼ã‚ã¾ã™ã€‚ 予約ã¯å…¥ã‚ŒãŸæ–¹ãŒæ™‚çŸã«ã€
怪ã—ã„ファイルをピンãƒã‚¤ãƒ³ãƒˆã§ã‚¦ã‚£ãƒ«ã‚¹ãƒã‚§ãƒƒã‚¯ã§ãる『VirusChief〠- 100SHIKI ～ 世界ã®ã‚¢ã‚¤ãƒ‡ã‚¢ã‚’日替ã‚り㧠～
ダウンãƒãƒ¼ãƒ‰ã—ãŸã“ã®ãƒ•ã‚¡ã‚¤ãƒ«ã€ä¾¿åˆ©ãã†ã ã‘ã©ã¡ã‚‡ã£ã¨æ€ªã—ã„ã‹ã‚‚・・・ã¨ã„ã†ã¨ãã«ä½¿ãˆãã†ãªãƒ„ールã®ã”紹介。 Virus Chiefã¯ãƒ–ラウザ上ã§æ€ªã—ã„ファイルã®ã‚¦ã‚¤ãƒ«ã‚¹ãƒã‚§ãƒƒã‚¯ãŒã§ãã¦ã—ã¾ã†ã€‚ 使ã„æ–¹ã¯ç°¡å˜ã§ã€ã“ã®ã‚µã‚¤ãƒˆã§ãƒ•ã‚¡ã‚¤ãƒ«ã‚’アップã™ã‚‹ã ã‘ã§CalmAVã‚„AntiVirãªã©è¤‡æ•°ã®ã‚¢ãƒ³ãƒã‚¦ã‚¤ãƒ«ã‚¹ã‚½ãƒ•ãƒˆã§ãƒã‚§ãƒƒã‚¯ã€çµæžœã‚’æ•™ãˆã¦ãれる。 ã‚€ã‚ã‚“100ï¼…ä¿éšœã—ã¦ãれるã‚ã‘ã§ã¯ãªã„ãŒã€è»¢ã°ã¬å…ˆã®æ–çš„ã«ä½¿ã†ã“ã¨ãŒã§ãã‚‹ã ã‚ã†ã€‚ アンãƒã‚¦ã‚¤ãƒ«ã‚¹ã‚½ãƒ•ãƒˆã‚’常備ã—ã¦ã„る人も多ã„ã ã‚ã†ãŒã€å‡ºå…ˆã®ãƒ‘ソコンãªã©ã§ä½¿ãˆãã†ã 。家ã«ã¯ã‚ã‚‹ãŒã€å‡ºå…ˆã«ã¯ãªã„・・・ãã†ã—ãŸãƒ„ールã«æ–°ã—ã„サービスã®ãƒ’ントãŒã‚ã‚Šãã†ã§ã™ã。
トラックãƒãƒƒã‚¯ã‚¹ãƒ‘ムよã‘ã«ã‚‚使ãˆã‚‹ã€Œmod_securityã€
Apacheã‚’ã‚»ã‚ュアã«ã™ã‚‹ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã§ã€Œmod_securityã€ã¨ã„ã†ã®ãŒã‚ã‚‹ãã†ã§ã€‚ã„ã‚ゆるWeb Application Firewall (WAF)ã¨ã„ã†ã‚‚ã®ã«åˆ†é¡žã•ã‚Œã‚‹ä»•çµ„ã¿ãªã®ã§ã™ãŒã€éžå¸¸ã«æ©Ÿèƒ½ãŒå¼·åŠ›ã€‚ヘッダã€GETã€POSTã€ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’å«ã‚€INã¨OUTã®å…¨ãƒªã‚¯ã‚¨ã‚¹ãƒˆï¼ˆHTTPSå«ã‚€ï¼‰ã«å¯¾ã—ã¦ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°å¯èƒ½ã€‚通常ã§ã¯è¨˜éŒ²ã•ã‚Œãªã„POSTã®ãƒã‚°ã‚‚記録å¯èƒ½ã€‚ ã§ã€ã“ã®æ©Ÿèƒ½ã‚’使ãˆã°ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ã‚¹ãƒ‘ムもサーãƒå´ã§å§‹æœ«ã§ãã‚‹ã®ã§ã€PHPãªã©ãŒå‹•ã„ã¦åˆ¤å®šã™ã‚‹å‰ã«å‡¦ç†ã§ãã€ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ã‚¹ãƒ‘ムã«ã‚ˆã‚‹è² è·ãŒè»½ããªã‚‹ã¨ã„ã†ã‚ã‘。 è¨å®šã®è©³ç´°ãªã©ã¯ä»¥ä¸‹ã®é€šã‚Šã€‚mod_security用ã®ãƒ–ラックリストもダウンãƒãƒ¼ãƒ‰ã§ãã‚‹ã®ã§è¨å®šã‚‚ç°¡å˜ã§ã™ã€‚ å…¬å¼ã‚µã‚¤ãƒˆã¯ä»¥ä¸‹ã€‚ ModSecurity (mod_security) - Open Source Web Application Firewal
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - サイボウズ「闇改修ã€ã®ä»¶ã®ãã®å¾Œ, テスト用エントリ
■サイボウズ「闇改修ã€ã®ä»¶ã®ãã®å¾Œ 一昨日ã®æ—¥è¨˜ã®ä»¶*1ã«ã¤ã„ã¦ã€å‡ºå‹¤å‰ã®åˆå‰ä¸ã«ã‚µã‚¤ãƒœã‚¦ã‚ºã®ãŠå®¢ã•ã¾å¯¾å¿œçª“å£ã‹ã‚‰é›»è©±ãŒã‚ã£ãŸã€‚ 電話ã®è¦ä»¶ã¯è¨‚æ£ãŒã‚ã‚‹ã¨ã®ã“ã¨ã§ã€ä»¥ä¸‹ã®3点を訂æ£ã™ã‚‹ã¨ã®ã“ã¨ã ã£ãŸã€‚（以下ã¯ç§ã«ã‚ˆã‚‹è¦ç´„。） ディレクトリトラãƒãƒ¼ã‚µãƒ«ã®è„†å¼±æ€§ã«ã¤ã„ã¦ã¯ã€ãƒã‚°ã‚¤ãƒ³ã—ã¦ã„ãªã„者ã«ã‚ˆã£ã¦ã‚‚攻撃ã•ã‚Œå¾—る。告知文を訂æ£ã™ã‚‹ã€‚ ユーザã®ä¸€è¦§ã‚’å–å¾—ã§ãã¦ã—ã¾ã†å•é¡Œã«ã¤ã„ã¦ã€è„†å¼±æ€§ã¨ã—ãªã‹ã£ãŸã®ã¯ã€é‡è¦åº¦ãŒä½Žã„ã¨è©•ä¾¡ã—ã¦ã„ãŸã¨ã„ã†èª¤ã£ãŸèªè˜ã«ã‚ˆã‚‹ã‚‚ã®ã ã£ãŸã€‚告知文を訂æ£ã™ã‚‹ã€‚ 去年ã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティング脆弱性対応ã«ã¤ã„ã¦ã€å¯¾ç–ã¨ã—ã¦è¿½åŠ ã•ã‚ŒãŸè¦å‘Šè¡¨ç¤ºæ©Ÿèƒ½ãŒãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã‚ªãƒ•ã¨ãªã£ã¦ã„ã‚‹ç†ç”±ã¯ã€æ—¢å˜ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¨ã®äº’æ›æ€§ã‚’考ãˆãŸã‚‚ã®ã§ã‚ã‚Šã€ãã‚Œã¯ãƒ¦ãƒ¼ã‚¶ãŒæ··ä¹±ã™ã‚‹ã®ã§ã¯ãªã„ã‹ã¨è€ƒãˆãŸãŸã‚ã§ã€ãã®ã‚ˆã†ãªèªè˜ã¯èª¤ã‚Šã ã£ãŸã€‚今後ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã‚ªãƒ³ã¨ã™ã‚‹ã‚ˆã†ã«æ¤œè¨Žã™ã‚‹ã€‚ ãã—ã¦ã•ãã»ã©å‘ŠçŸ¥ãƒšãƒ¼ã‚¸
PragDave: Prompting for Rails Database Password
Mike and I are running a Rails Studio in Denver. We were talking about database configuration, and an attendee asked "How can I make Rails prompt me for the database password, rather than hard code it into a configuration file?" It turns out that's easy to do, because the Rails configuration files are processed through the ERb templating system. Here's what the production stanza looks like in the
Session hijacking - Ruby on Rails Security Project
Session hijacking is a class of attacks where an attacker gets hold of a session identifer of another user. Consequently, he gets access to the web application, because the sessionidentifer serves as temporary login credential. The most popular way of hijacking a session is to steal the session identifer. There are several ways doing this.Most cross-site scripting attacks aim at stealing a user's
「拡張åã§ã¯ãªãã€å†…容ã«ã‚ˆã£ã¦ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–‹ãã“ã¨ã€ã®æ‹¡å¼µå㯠Content-Type ã§ã¯ãªã„ã“ã¨ã«æ³¨æ„ - 葉ã£ã±æ—¥è¨˜
å°‘ã—å‰ã« JSONP ㌠XSS を引ãèµ·ã“ã™ã‹ã‚‚ã—ã‚Œãªã„ã¨ã„ã†ç‚¹ã«é–¢ã™ã‚‹èˆˆå‘³æ·±ã„記事を奥ã•ã‚“ãŒæ›¸ã‹ã‚Œã¦ã„ã¾ã—ãŸã€‚ Kazuho@Cybozu Labs: JSONP - データæ供者å´ã®ã‚»ã‚ュリティã«ã¤ã„㦠JSONP ã«ãŠã‘ã‚‹ Padding 部分(ã ã‘ã§ãªãJSON部分も。4/5追記)ã«æ”»æ’ƒè€…㌠HTML ã¨è§£é‡ˆå¯èƒ½ãªã‚¹ã‚¯ãƒªãƒ—トを注入ã™ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€JSONP ãªãƒ‡ãƒ¼ã‚¿ã‚’直接 IE ã§é–‹ã„ãŸå ´åˆã« HTML ã¨è§£é‡ˆã•ã‚Œ XSS ãŒç™ºç”Ÿã™ã‚‹ã€ã¨ã„ã†ç‚¹ã«ã¤ã„ã¦æ›¸ã‹ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã“ã§ã€IE ㌠JSONP ã‚’ HTML ã¨è§£é‡ˆã™ã‚‹ç†ç”±ã¯ä»¥ä¸‹ã®2点。 IEã®ã‚ˆã知られãŸæ©Ÿèƒ½ã€Œæ‹¡å¼µåã§ã¯ãªãã€å†…容ã«ã‚ˆã£ã¦ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–‹ãã“ã¨ã€ã«ã‚ˆã‚Šã€å†…容㌠HTML ã£ã½ã„å ´åˆã«ã¯ã€Content-Type: text/javascript ãŒç„¡è¦–ã•ã‚Œ HTML ã¨ã—ã¦è§£é‡ˆã•ã‚Œã‚‹ã€‚ 上述ã®è¨å®šãŒã€Œç„¡åŠ¹ã€ã«è¨å®š
Ruby 㧠OpenSSL ã®ä¹±æ•°ç”Ÿæˆã‚’利用ã™ã‚‹ - WebOS Goodies
å˜ç´”ãªä¹±æ•°ã‚ˆã‚Šã ã„ã¶è‰¯ããªã£ã¦ã„ã¾ã™ãŒã€ãã‚Œã§ã‚‚æ€ã£ãŸã‚ˆã‚Šã‚·ãƒ³ãƒ—ルã§ã™ã。ã¾ãŸã€æœ€å¾Œã« MD5 ã‚’ã‹ã‘ã‚‹ã¨ã€ ID ã®é•·ã•ãŒå›ºå®šã•ã‚Œã¦ã—ã¾ã†ï¼ˆéµç©ºé–“ã®åºƒã•ã‚’調整ã§ããªã„）ã¨ã„ã†æ¬ 点もã‚ã‚Šã¾ã™ã€‚çŸæœŸé–“ã—ã‹ä½¿ã‚ãªã„セッション ID ãªã‚‰å¤§ä¸ˆå¤«ã§ã—ょã†ãŒã€æ°¸ç¶šçš„㪠ID ã¨ã—ã¦ã¯ã¡ã‚‡ã£ã¨ä¸å®‰ãŒæ®‹ã‚Šã¾ã™ã€‚ ãªã«ã‹ Ruby ã§ç°¡å˜ã«å¼·å›ºãª ID を生æˆã™ã‚‹æ–¹æ³•ã¯ãªã„ã‹ãªãã€ã¨è€ƒãˆã¦ã„ãŸã®ã§ã™ãŒã€ãã†ã„ãˆã° Ruby ã«ã¯ OpenSSL ãƒã‚¤ãƒ³ãƒ‰ãŒæ¨™æº–ã§æ·»ä»˜ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚強力ãªæš—å·åŒ–ã«ã¯äºˆæ¸¬å›°é›£ã§åã‚Šã®å°‘ãªã„乱数ãŒä¸å¯æ¬ ã§ã™ã‹ã‚‰ã€ã“ã‚Œã¯æœŸå¾…ã§ãã¾ã™ã。ãã‚“ãªã‚ã‘ã§ã€ Ruby ã‹ã‚‰ OpenSSL ã®ä¹±æ•°ç”Ÿæˆå™¨ã‚’利用ã™ã‚‹æ–¹æ³•ã‚’調ã¹ã¦ã¿ã¾ã—ãŸã®ã§ã€æœ¬æ—¥ã¯ãれをã”紹介ã—よã†ã¨æ€ã„ã¾ã™ã€‚ 調ã¹ã¦ã¿ãŸã¨ã“ã‚〠C 言語ãªã‚‰ OpenSSL ã®ä¹±æ•°ã¯ RAND_bytes ã¨ã„ã†é–¢æ•°ã§åˆ©ç”¨ã§ãるよã†ã§ã™ã€‚
SQL Injection Cheat Sheet
Examples; (MS) means : MySQL and SQL Server etc. (M*S) means : Only in some versions of MySQL or special conditions see related note and SQL Server Table Of Contents About SQL Injection Cheat Sheet Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks Line Comments SQL Injection Attack Samples Inline Comments Classical Inline Comment SQL Injection Attack Samples MySQL Vers
bcrypt-ruby: Secure Password Hashing | Archives | codablog | Coda Hale
Coda Hale lives in Berkeley, CA, where he writes about Ruby on Rails, usability, web design and development, and the occasional bit about bicycles. bcrypt-ruby: Secure Password Hashing The Problem So you remember how Reddit got a backup copy of their database stolen? Do you also remember how, since they stored users’ passwords as plain text, the hacker also got a big list of people’s email address
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Rad.
http://www.quarkruby.com/2007/9/20/ruby-on-rails-security-guide
http://japan.internet.com/webtech/20060613/11.html
{{#tags}}- {{label}}
{{/tags}}