[B! security] terurouã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

terurou id:terurou

securityã«é–¢ã™ã‚‹terurouã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (111)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

èªè¨¼ã—ãªã„Webèªè¨¼ é™å®šå…¬é–‹URLã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦è€ƒãˆã‚‹ å…¬é–‹ç‰ˆ
èªè¨¼ã—ãªã„Webèªè¨¼ é™å®šå…¬é–‹URLã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦è€ƒãˆã‚‹ 2020/8/7 API Meetup Online #3- ãƒ•ãƒ¥ãƒ¼ãƒãƒ£ãƒ¼æ ªå¼ä¼šç¤¾ æ¸‹å·ã‚ˆã—ã
terurou 2020/08/11
url

security

authentication

architecture
ãƒªãƒ³ã‚¯
Node.jsã«ãŠã‘ã‚‹ãƒ—ãƒãƒˆã‚¿ã‚¤ãƒ—æ±šæŸ“æ”»æ’ƒã¨ã¯ä½•ã‹ - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã« æœ€è¿‘ã‚ã‘ã‚ã£ã¦Nodeã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£èª¿æŸ»ã‚’ã—ã¦ã„ã‚‹ã®ã§ã™ãŒã€ä»Šå¹´ã®5æœˆã«é–‹å‚¬ã•ã‚ŒãŸ North Sec 2018 ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã® Olivier Arteau æ°ã«ã‚ˆã‚‹ ã€ŒPrototype pollution attacks in NodeJS applicationsã€ã¨ã„ã†é¢ç™½ã„ç™ºè¡¨ã‚’è¦‹ã¤ã‘ã¾ã—ãŸã€‚ ã“ã®ç™ºè¡¨ã®è«–æ–‡ã‚„ç™ºè¡¨è³‡æ–™ã€ãƒ‡ãƒ¢å‹•ç”»ãªã©ã‚‚githubã§å…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã—ã€ã¡ã‚‡ã†ã©ã‚¿ã‚¤ãƒŸãƒ³ã‚°ã‚ˆãã‚»ãƒƒã‚·ãƒ§ãƒ³å‹•ç”»ã‚‚æœ€è¿‘å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ github.com Olivier Arteau -- Prototype pollution attacks in NodeJS applications ã“ã®ç™ºè¡¨ã§è§£èª¬ã•ã‚Œã¦ã„ã‚‹ã®ã¯ã€æ‚ªæ„ã®ã‚ã‚‹æ”»æ’ƒè€…ãŒã€JavaScriptè¨€èªžå›ºæœ‰ã®ãƒ—ãƒãƒˆã‚¿ã‚¤ãƒ—ãƒã‚§ãƒ¼ãƒ³ã®æŒ™å‹•ã‚’åˆ©ç”¨ã—ã¦ã€Webã‚µãƒ¼ãƒã‚’æ”»æ’ƒã™ã‚‹æ–¹æ³•ã§ã™ã€‚ ç™ºè¡¨è€…ã¯ã€npmã‹ã‚‰ãƒ€
terurou 2018/10/19
å®‰ç›´ãªObjectã®ãƒžãƒ¼ã‚¸ã€JSã®æ–‡åŒ–ã ã¨å‰²ã¨ã‚„ã‚‰ã‚Œã¡ã‚ƒã£ã¦ã‚‹ã‚“ã‚ˆãã€‚ã‚ã¨ä¾‹ãŒã‚µãƒ¼ãƒãƒ¼ã‚µã‚¤ãƒ‰ã ã‘ã©ã€PWAã‚„ã‚‰ReactNativeã‚„ã‚‰ã§ã‚‚åŒã˜ã“ã¨ã«ãªã‚‹ã‚“ã‚ˆãã€‚

javascript

security
ãƒªãƒ³ã‚¯
ã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã™ã‚‹ã«ã‚ãŸã£ã¦å–å¾—ã•ã‚ŒãŸããªã„ã‚¢ã‚«ã‚¦ãƒ³ãƒˆåãŒé›†ã¾ã£ã¦ã„ã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªãŒæ¬²ã—ã„ã‚“ã§ã™ã‘ã©ã€œã¿ãŸã„ãªæ™‚ - ãã®æ‰‹ã®å¹³ã¯å°»ã‚‚ã¤ã‹ã‚ã‚‹ã•
ä¾‹ãˆã° `logout` ã¿ãŸã„ãªãƒ¦ãƒ¼ã‚¶åã‚’å–å¾—ã•ã‚Œã¦ã—ã¾ã†ã¨ï¼Œãƒ¦ãƒ¼ã‚¶å´ã‹ã‚‰ã™ã‚‹ã¨ä¸æ°—å‘³ã«è¦‹ãˆã‚‹ã—ï¼ŒURLè¨è¨ˆãŒçµ‚äº†ã—ã¦ã„ã‚‹æ™‚ãªã©ã«è„†å¼±æ€§ã«ãªã‚Šå¾—ã‚‹ (ã¨ã¯è¨€ã†ã‚‚ã®ã®ï¼Œãã‚‚ãã‚‚ãã†ã„ã£ãŸè„†å¼±æ€§ã¯æ ¹æœ¬çš„ã«é˜²ãã¹ãã ã—ï¼ŒURLè¨è¨ˆã‚’çµ‚äº†ã•ã›ã¦ã¯ãªã‚‰ãªã„)ï¼Ž ã®ã§ï¼Œã‚¿ã‚¤ãƒˆãƒ«ã®ã‚ˆã†ãªã“ã¨ã‚’postã—ãŸã‚‰çŸ¥è¦‹ãŒãƒ¢ãƒªãƒ¢ãƒªé›†ã¾ã£ã¦ããŸï¼Žã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ï¼Ž å–å¾—ã•ã›ãŸããªã„ã‚¢ã‚«ã‚¦ãƒ³ãƒˆåã‚’é›†ã‚ã¦ã‚ã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªæ¬²ã—ã„æ°—ãŒã™ã‚‹ï¼Žauthã¨ã‹logoutã¨ã‹dataã¨ã‹â€¦â€¦â€” ã‚¢ãƒ‰ã‚»ãƒ³ã‚¹ã‚¯ãƒªãƒƒã‚¯ãŠé¡˜ã„ã—ã¾ã™å¤ªéƒŽ (@moznion) 2017å¹´4æœˆ10æ—¥ @moznion æ‰€å¾—ã•ã›ãŸããªã„ã‚¢ã‚«ã‚¦ãƒ³ãƒˆåãƒªã‚¹ãƒˆãªã‚‰ã“ã†ã„ã†ãƒ¬ãƒã‚¸ãƒˆãƒªãŒã‚ã‚Šã¾ã™ https://t.co/uyYJxaFbrXâ€” kosuge (@9m) 2017å¹´4æœˆ10æ—¥ @moznion ã“ã®ãƒªã‚¹ãƒˆã«è¿½åŠ ã§æ—¥æœ¬å‘ã‘ã« regist ã£ã¦ã„ã†ã‚¢ã‚«
terurou 2017/08/24
webservice

account

security

NGãƒ¯ãƒ¼ãƒ‰
ãƒªãƒ³ã‚¯
ã‚¯ãƒ©ã‚¦ãƒ‰ç ´ç”£ã—ãªã„ã‚ˆã†ã« git-secrets ã‚’ä½¿ã† - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
terurou 2016/09/12
Git

security

git-secrets
ãƒªãƒ³ã‚¯
GitHub - awslabs/git-secrets: Prevents you from committing secrets and credentials into git repositories
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
terurou 2016/09/12
Git

security

git-secrets
ãƒªãƒ³ã‚¯
ã‚µãƒ¼ãƒã®è„†å¼±æ€§ãƒã‚§ãƒƒã‚¯ã§ãã‚‹Vulsã‚’dockerã‚’ä½¿ã£ã¦è©¦ã—ãŸ - tjinjin's blog
ä¸–ã®ã‚¤ãƒ³ãƒ•ãƒ©ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æ–¹ã€…ã¯ã€ä½•ã‚‰ã‹ã®å½¢ã§åˆ©ç”¨ã—ã¦ã„ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ±ã‚’æ—¥ã€…ãƒã‚§ãƒƒã‚¯ã—ã¦ã„ã‚‹ã¨æ€ã„ã¾ã™ã€‚ã—ã‹ã—ã€åˆ©ç”¨ã™ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãŒå¢—ãˆã¦ãã‚‹ã¨å…¨éƒ¨ã®ãƒã‚§ãƒƒã‚¯ã¯ãªã‹ãªã‹é›£ã—ã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚ ãã‚“ãªä¸æœ€è¿‘Amazon InspectorãŒãƒ—ãƒ¬ãƒ“ãƒ¥ãƒ¼ã‹ã‚‰ä¸€èˆ¬åˆ©ç”¨é–‹å§‹ã¨ãªã‚Šã€æ³¨ç›®ã•ã‚Œã¦ã„ã‚‹æ–¹ã‚‚ã„ã‚‹ã¨æ€ã„ã¾ã™ã€‚ãã†ã„ã£ãŸãƒ„ãƒ¼ãƒ«ãŒæ§˜ã€…å‡ºã‚‹ä¸ã§ã€æœ€è¿‘Vulsã¨ã„ã†ã‚‚ã®ã‚’çŸ¥ã£ãŸã®ã§è©¦ã—ã¦ã¿ãŸã„ã¨æ€ã„ã¾ã™ã€‚ Vulsã¨ã¯ Amazon Inspectorã¨ã®é•ã„ go-cve-dictionaryã«ã¤ã„ã¦ å®Ÿéš›ã«ä½¿ã£ã¦ã¿ã‚‹ æ¤œè¨¼ç’°å¢ƒã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ Vuls server scanå¯¾è±¡ã‚µãƒ¼ãƒ äº‹å‰æº–å‚™ slacké€šçŸ¥ã‚’è©¦ã™ TUIï¼ˆTerminal-Based User Interfaceï¼‰ã‚’è©¦ã™ OSãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ä»¥å¤–ã‚‚ãƒã‚§ãƒƒã‚¯ã™ã‚‹ ã¾ã¨ã‚ Vulsã¨ã¯ github.com scan
terurou 2016/06/27
security

Docker

vuls
ãƒªãƒ³ã‚¯
iframe sandbox ã¯ä¸‡èƒ½ã§ã¯ãªã„ - è‘‰ã£ã±æ—¥è¨˜
HTML5ã§å°Žå…¥ã•ã‚ŒãŸiframeè¦ç´ ã®sandboxå±žæ€§ã¯ã€ãã®iframeå†…ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«å¯¾ã—JavaScriptã®å®Ÿè¡Œã‚’å§‹ã‚æ§˜ã€…ãªåˆ¶ç´„ã‚’èª²ã™ã“ã¨ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å‘ä¸Šã«å½¹ç«‹ã¤æ©Ÿèƒ½ã§ã‚ã‚‹ã€‚ä¾‹ãˆã°ã€ä»¥ä¸‹ã®ã‚ˆã†ã«æŒ‡å®šã•ã‚ŒãŸiframeã§ã¯ã€iframeå†…ã‹ã‚‰formã®submitãªã©ã¯ã§ãã‚‹ãŒã€iframeå†…ã§ã®JavaScriptã®å®Ÿè¡Œã‚„target=_blankãªã©ã«ã‚ˆã£ã¦ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã‚’é–‹ãã“ã¨ãªã©ã¯ç¦æ¢ã•ã‚Œã‚‹ã€‚ <iframe sandbox="allow-forms" src="..."></iframe> sandboxå±žæ€§ã«æ˜Žç¤ºçš„ã« allow-scripts ã¨ã„ã†å€¤ã‚’æŒ‡å®šã—ãªã„é™ã‚Šã¯iframeå†…ã§ã¯ç›´æŽ¥çš„ã«ã¯JavaScriptã¯å®Ÿè¡Œã§ããªã„ãŒã€ã‹ã¨ã„ã£ã¦iframeå†…ã‹ã‚‰é–“æŽ¥çš„ã«JavaScriptã‚’å¿…ãšã—ã‚‚å®Ÿè¡Œã•ã›ã‚‹ã“ã¨ãŒä¸å¯èƒ½ã‹ã¨ã„ã†ã¨ãã†ã§ã‚‚ãªã„ã€‚ sandboxå±žæ€§
terurou 2016/02/14
javascript

security

sandbox

html5
ãƒªãƒ³ã‚¯
Electronã®webviewè¦ç´ ã§ã¯allowpopupså±žæ€§ã‚’ã¤ã‘ã¦ã¯ã„ã‘ãªã„ - è‘‰ã£ã±æ—¥è¨˜
Electronã‚’ä½¿ã£ã¦ãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚ˆã†ãªã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œã‚‹å ´åˆã«ã¯ webviewã‚¿ã‚°ãŒä½¿ç”¨ã•ã‚Œã‚‹ã€‚ä¾‹ãˆã°ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å†…ã«example.jpã®ã‚µã‚¤ãƒˆã‚’è¡¨ç¤ºã™ã‚‹ã«ã¯ä»¥ä¸‹ã®ã‚ˆã†ã«HTMLã«è¨˜è¿°ã™ã‚‹ã€‚ <webview src="http://example.jp/"></webview> ã“ã“ã§ã€webviewã‚¿ã‚°ã«allowpopupså±žæ€§ã‚’ä»˜ä¸Žã™ã‚‹ã¨ã€example.jpã‚µã‚¤ãƒˆå†…ã®ã‚³ãƒ¼ãƒ‰ã‹ã‚‰window.openç‰ã‚’ä½¿ã£ã¦æ–°ãŸã«ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã‚’é–‹ãã“ã¨ãŒã§ãã‚‹ã‚ˆã†ã«ãªã‚‹ã€‚ã“ã®ã¨ãã€example.jpã«æ‚ªæ„ãŒã‚ã‚Šä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ãŒå«ã¾ã‚Œã¦ã„ã‚‹ã¨ã™ã‚‹ã€‚ if( typeof require === "undefined" ) window.open( 'http://example.jp/', '', 'nodeIntegration=1'); else require( "chi
terurou 2016/01/25
Electron

security
ãƒªãƒ³ã‚¯
Electronã§ã‚¢ãƒ—ãƒªã‚’æ›¸ãå ´åˆã¯ã€æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’ç™ºç”Ÿã•ã›ãªã„ã‚ˆã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ - è‘‰ã£ã±æ—¥è¨˜
ãã®ã†ã¡ã‚‚ã†å°‘ã—ãã¡ã‚“ã¨æ›¸ãã¾ã™ãŒã€ã¨ã‚Šã‚ãˆãšæ™‚é–“ãŒãªã„ã®ã§çµè«–ã ã‘æ›¸ãã¨ã€ã‚¿ã‚¤ãƒˆãƒ«ãŒå…¨ã¦ã§Electronã§ã‚¢ãƒ—ãƒªã‚’æ›¸ãå ´åˆã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’ç™ºç”Ÿã•ã›ãªã„ã‚ˆã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ ã“ã‚Œã¾ã§Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ä¸Šã§XSSãŒå˜åœ¨ã—ãŸã¨ã—ã¦ã‚‚ã€å½±éŸ¿ç¯„å›²ã¯ãã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä¸ã«ç•™ã¾ã‚‹ã®ã§ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®æä¾›å´ãŒãã‚Œã‚’è¨±å®¹ã™ã‚‹ã®ã§ã‚ã‚Œã°XSSã®å˜åœ¨ã«ç›®ã‚’ã¤ã‚€ã‚‹ã“ã¨ã‚‚ã§ããŸã€‚ã—ã‹ã—ã€Electronã‚¢ãƒ—ãƒªã§DOM-based XSSãŒä¸€ã‹æ‰€ã§ã‚‚ç™ºç”Ÿã™ã‚‹ã¨ã€(ãŠãã‚‰ã)ç¢ºå®Ÿã«ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã¸ã¨ã¤ãªãŒã‚Šã€åˆ©ç”¨è€…ã®PCã®(ãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼æ¨©é™ã§ã®)å…¨æ©Ÿèƒ½ãŒæ”»æ’ƒè€…ã«ã‚ˆã£ã¦åˆ©ç”¨ã§ãã‚‹ã€‚ ãã®ãŸã‚ã€Electronã§ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œæˆã™ã‚‹é–‹ç™ºè€…ã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’å®Œå…¨ã«ã¤ã¶ã•ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ nodeIntegration:falseã‚„Content-Security-Pol
terurou 2015/12/25
WinRTã¿ãŸã„ãªSandboxæŒŸã¾ãªã„ã¨ã©ã†ã«ã‚‚ã§ããªã„å•é¡Œãªã®ã‚ˆãªã

Electron

security
ãƒªãƒ³ã‚¯
JSè‡ªå‹•ãƒ¬ãƒ“ãƒ¥ãƒ¼ãƒ„ãƒ¼ãƒ«"jswatchdog"ã‚’å…¬é–‹ã—ã¾ã—ãŸ - Cybozu Inside Out | ã‚µã‚¤ãƒœã‚¦ã‚ºã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãƒ–ãƒã‚°
ã“ã‚“ã«ã¡ã¯ã€‚kintone é–‹ç™ºãƒãƒ¼ãƒ ã®å¤©é‡Ž (@ama_ch) ã§ã™ã€‚ã™ã£ã‹ã‚Šæ˜¥ã‚‰ã—ããªã‚Šã¾ã—ãŸãã€‚ å°‘ã—å‰ã« JS ã®è‡ªå‹•ãƒ¬ãƒ“ãƒ¥ãƒ¼ãƒ„ãƒ¼ãƒ« jswatchdog ã‚’ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã§å…¬é–‹ã—ã¾ã—ãŸã®ã§ã€ã“ã¡ã‚‰ã§ç´¹ä»‹ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ ä½¿ã„æ–¹ https://kintone.github.io/jswatchdog/ ä¸Šè¨˜ã® URL ã‚’é–‹ãã€å·¦å´ã®ã‚¨ãƒ‡ã‚£ã‚¿ã« JS ã‚³ãƒ¼ãƒ‰ã‚’è²¼ã‚Šä»˜ã‘ã‚‹ã ã‘ã§ã™ã€‚ å³å´ã«ä¿®æ£ãŒå¿…è¦ãªç®‡æ‰€ãŒè¡¨ç¤ºã•ã‚Œã‚‹ã®ã§ã€é©å®œä¿®æ£ã—ã¾ã™ã€‚ ç‰¹å¾´ ãƒãƒªãƒãƒªã®é–‹ç™ºè€…ã˜ã‚ƒãªãã¦ã‚‚ä½¿ã„ã‚„ã™ã„ä¸€ç”»é¢å®Œçµã® Web ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ lint ãƒ„ãƒ¼ãƒ«ã§ãŠé¦´æŸ“ã¿ã®æ§‹æ–‡ãƒã‚§ãƒƒã‚¯ã®ä»–ã€çŸ¥ã‚‰ãšã«è„†å¼±æ€§ã‚’ä½œã‚Šè¾¼ã‚€ã“ã¨ã‚’é¿ã‘ã‚‹ãŸã‚ã€XSS ã®å¯èƒ½æ€§ãŒã‚ã‚‹ç®‡æ‰€ã«ã‚‚è¦å‘Šã‚’è¡¨ç¤º å†…éƒ¨çš„ã«ã¯ã€JS ã®é™çš„æ§‹æ–‡ãƒã‚§ãƒƒã‚¯ãƒ„ãƒ¼ãƒ«ã¨ã—ã¦ ESLint ã¨ JSHint ã‚’çµ„ã¿è¾¼ã‚“ã§ã„ã¾ã™ã€‚ ã•ã‚‰ã« XSS ã®å¯èƒ½æ€§ãŒã‚
terurou 2015/04/08
javascript

security

lint
ãƒªãƒ³ã‚¯
ãƒ©ãƒƒã‚¯ã®æ‰±ã‚ã‚Œæ–¹ã«è¦‹ã‚‹è„†å¼±æ€§èª¿æŸ»ã®ã‚ã‚Šæ–¹ | ã‚¯ãƒã‚¹ã‚¸ãƒ¼ãƒ«
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³åˆ¤æ±ºãŒåºƒã¾ã‚Šã‚’è¦‹ã›ã¦ã„ã¾ã™ å…ˆæ—¥ã€ä»¥ä¸‹ã®è¨˜äº‹ã‚’æ›¸ãã¾ã—ãŸã€‚ ãƒ»SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã®æœ‰ç„¡ãŒé‡éŽå¤±ã®åˆ¤æ–ã«å½±éŸ¿ã‚’ä¸ŽãˆãŸåˆ¤æ±º http://www.crosszeal.co.jp/blog/20150209_sqlã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã®æœ‰ç„¡ãŒé‡éŽå¤±ã®åˆ¤æ–ã«å½±éŸ¿ã‚’ä¸ŽãˆãŸåˆ¤æ±º.html ã“ã®è¨˜äº‹ã«ã‚‚æ›¸ã„ãŸã¨ãŠã‚Šã€åŒ—æµ·é“å¤§å¦ã®ç”ºæ‘å…ˆç”Ÿã€HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°ã®å¾³ä¸¸å…ˆç”Ÿã®ã‚¨ãƒ³ãƒˆãƒªã§ã“ã®ä»¶ã‚’çŸ¥ã‚Šãƒ–ãƒã‚°ã‚’æ›¸ã„ãŸã‚ã‘ã§ã™ãŒã€åŒã˜æ–¹ã€…ã‚‚å¤šã„ã‚ˆã†ã§ã€ã“ã®åˆ¤æ±ºã«é–¢ã™ã‚‹æƒ…å ±ã‚„æ„è¦‹ãŒæ¤œç´¢ã§å¤šããƒ’ãƒƒãƒˆã™ã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ ä¸ã«ã¯ã€Œè„†å¼±æ€§ãŒä¸€ã¤ã§ã‚‚ã‚ã£ãŸã‚‰æå®³è³ å„ŸãŒèªã‚ã‚‰ã‚Œã‚‹ã€ã¨ã„ã£ãŸèª¤ã£ã¦ã„ã‚‹èªè˜ã§ã‚ã£ãŸã‚Šã€ã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚’ã—ãŸã‚‰è²»ç”¨ãŒå¤šãã‹ã‹ã£ã¦ã—ã¾ã†ã€ã¨ã„ã£ãŸé¦–ã‚’ã‹ã—ã’ã‚‹æ„è¦‹ã‚‚ã‚ã‚Šã¾ã™ãŒã€ã“ã†ã„ã£ãŸæƒ…å ±ãŒåºƒã¾ã‚‹ã®ã¯è‰¯ã„ã“ã¨ã ã¨æ€ã„ã¾ã™ã€‚ä»Šå¾Œåºƒã¾ã£ã¦ã„ãä¸ã§ã€æ£ã—ã„èª
terurou 2015/03/23
èª¿æŸ»ä¼šç¤¾ã¤ã‚‰ã„

security

è£åˆ¤
ãƒªãƒ³ã‚¯
WebRTC is secure,ï¿½ or not secure? - WebRTC ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¦‚èª¬ -
WebRTC is secure,ï¿½ or not secure? - WebRTC ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¦‚èª¬ -
terurou 2015/01/30
WebRTC

security
ãƒªãƒ³ã‚¯
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚‚ã‚Œã®è²¬ä»»ã‚’é–‹ç™ºä¼šç¤¾ã«å•ã†åˆ¤æ±º
ãƒã‚¤ãƒ³ãƒˆã¯ä¸‹è¨˜ã®é€šã‚Šã§ã™ã€‚ Xç¤¾ï¼ˆåŽŸå‘Šï¼‰ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«ã¤ã„ã¦ç‰¹ã«æŒ‡ç¤ºã¯ã—ã¦ã„ãªã‹ã£ãŸ æå®³è³ å„Ÿã«ã¤ã„ã¦å€‹åˆ¥å¥‘ç´„ã«å®šã‚ã‚‹å¥‘ç´„é‡‘é¡ã®ç¯„å›²å†…ã¨ã™ã‚‹æå®³è³ å„Ÿè²¬ä»»åˆ¶é™ãŒã‚ã£ãŸ å½“åˆã‚·ã‚¹ãƒ†ãƒ ã¯ã‚«ãƒ¼ãƒ‰æ±ºæ¸ˆã‚’å¤–éƒ¨å§”è¨—ã—ç›´æŽ¥ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’æ‰±ã£ã¦ã„ãªã‹ã£ãŸ Xç¤¾ãŒã€Œã‚«ãƒ¼ãƒ‰ä¼šç¤¾æ¯Žã®æ±ºæ¸ˆé‡‘é¡ã‚’çŸ¥ã‚ŠãŸã„ã€ã¨Yç¤¾ã«ä¾é ¼ã‚’ã—ã¦ã€ãã®çµæžœã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ã„ã£ãŸã‚“DBã«ä¿å˜ã™ã‚‹ä»•æ§˜ã¨ãªã£ãŸï¼ˆ2010å¹´1æœˆ29æ—¥ï¼‰ Xç¤¾ã‹ã‚‰ã®å•ã„åˆã‚ã›ã«å¯¾ã—ã¦Yç¤¾ã¯ã€ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ä¿æŒã—ãªã„æ–¹å¼ã«å¤‰æ›´ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã€ãã®ã»ã†ãŒå®‰å…¨ã¨ãªã‚Šã€è²»ç”¨ã¯20ä¸‡å††ç¨‹åº¦ã§ã‚ã‚‹æ—¨ã‚’ä¼ãˆãŸï¼ˆ2010å¹´9æœˆ27æ—¥ï¼‰ãŒã€ãã®å¾ŒXç¤¾ã¯æ”¹è‰¯ã®æŒ‡ç¤ºã‚’ã—ãªã‹ã£ãŸ ä»¥ä¸‹ã®è„†å¼±æ€§ãã®ä»–ãŒèªã‚ã‚‰ã‚ŒãŸ ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†æ©Ÿèƒ½ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒ admin/password ã§ã‚ã£ãŸ å€‹äººæƒ…å ±ãŒè¨˜è¼‰ã•ã‚ŒãŸãŠå•ã„åˆã‚ã›ãƒã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®é–²è¦§ãŒå¯èƒ½ï¼ˆãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒªã‚¹ãƒ†ã‚£ãƒ³ã‚°ã¨æ„å›³ã—ãªã„ãƒ•ã‚¡ã‚¤
terurou 2015/01/22
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚’æ€ ã‚‹ã¨é‡éŽå¤±ã¨ãªã‚‹åˆ¤ä¾‹ã€‚å—è¨—ã‚’ã‚„ã‚‹ä¼šç¤¾ã¯ã¿ã‚“ãªçŸ¥ã£ã¦ãŠã‹ãªã„ã¨ã„ã‘ãªã„ã‚„ã¤ã

åˆ¤ä¾‹

security
ãƒªãƒ³ã‚¯
3må…ˆã‹ã‚‰æ’®ã£ãŸè¦ªæŒ‡ã®å†™çœŸã‹ã‚‰ã€æŒ‡ç´‹ã®è¤‡è£½ã«æˆåŠŸ
terurou 2015/01/05
security
ãƒªãƒ³ã‚¯
Content-Security-Policy ã¨ nonce ã®è©± - tokuhirom's blog
Content-Security-Policy ã® nonce ã‚’åˆ©ç”¨ã™ã‚‹ã¨ã€XSS ã®è„…å¨ã‚’ã‹ãªã‚Šè»½æ¸›ã§ãã¾ã™ã€‚ ãã“ã§ã€Web Application Framework ã§ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§å¯¾å¿œã—ãŸã»ã†ãŒã‚ˆã„ã®ã§ã¯ãªã„ã‹ã€ã¨ã„ã†æ—¨ã‚’ @hasegawayosuke ã•ã‚“ã‹ã‚‰æ•™ãˆã¦é ‚ã„ãŸã®ã§ã€å®Ÿè£…ã«ã¤ã„ã¦è€ƒãˆã¦ã¿ã¾ã—ãŸã€‚ ã¨ã‚Šã‚ãˆãš CSP ã® nonce ã¯ã©ã†ã„ã†ã‚‚ã®ãªã®ã‹ã‚’è€ƒæ…®ã™ã‚‹ãŸã‚ã«ã€ã‚³ãƒ¼ãƒ‰ä¾‹ã‚’æŽ¢ã—ã¦ã„ãŸã®ã§ã™ãŒã€å®Ÿéš›ã«å‹•ãã‚µãƒ³ãƒ—ãƒ«ã¨ã„ã†ã‚‚ã®ãŒ nonce é–¢é€£ã®ã‚‚ã®ã§è¦‹å½“ãŸã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ ãã“ã§ã€å®Ÿéš›ã«å‹•ãã‚µãƒ³ãƒ—ãƒ«ã‚’ç”¨æ„ã—ã¾ã—ãŸã€‚ https://github.com/tokuhirom/csp-nonce-sample ä»¥ä¸‹ã¯ Sinatra ã§æ›¸ã‹ã‚ŒãŸã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ã§ã™ã€‚ require 'sinatra' require 'securerandom' get '/' d
terurou 2014/09/26
xss

security

javascript

html
ãƒªãƒ³ã‚¯
è£½å“æƒ…å ±
æ‰‰ äº‹å‹™æ‰€ã‚„ãƒžãƒ³ã‚·ãƒ§ãƒ³ã€æˆ¸å»ºã¦ã®çŽ„é–¢æ‰‰ã«è£…ç€ã™ã‚‹è£½å“ã§ã™ã€‚ å…ˆé€²ã®é›»ååˆ¶å¾¡æŠ€è¡“ã‚’é§†ä½¿ã—ãŸå„ªã‚ŒãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç’°å¢ƒã‚’ã€å®‰ä¾¡ã«å°Žå…¥å¯èƒ½ã§ã™ã€‚
terurou 2014/05/24
ST-S1029C ä»»æ„ã®FeliCaã‚’éµã«ã§ãã‚‹é›»åãƒãƒƒã‚¯ã€‚

security

éµ
ãƒªãƒ³ã‚¯
æˆ‘ã€…ã¯ã©ã®ã‚ˆã†ã«ã—ã¦å®‰å…¨ãªHTTPSé€šä¿¡ã‚’æä¾›ã™ã‚Œã°è‰¯ã„ã‹ - Qiita
Modern Ciphersuite: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES1
terurou 2014/05/21
SSL

nginx

security
ãƒªãƒ³ã‚¯
ã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ã®é–‹ã„ãŸãƒ‘ãƒ³ãƒ‰ãƒ©ã®ç®±
ã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ã®é–‹ã„ãŸãƒ‘ãƒ³ãƒ‰ãƒ©ã®ç®± Opened Pandora's box of Cache Poisoning éˆ´æœ¨å¸¸å½¦ 2014.04.15 (Concept by å‰é‡Žå¹´ç´€ 2014.02) / English version èƒŒæ™¯ Kaminsky 2008å¹´ã€Dan Kaminsky æ°ãŒ TTL ã«å½±éŸ¿ã•ã‚Œãªã„æ¯’å…¥ã‚Œæ‰‹æ³•ã‚’ç™ºè¡¨ã—ãŸã€‚ ã—ã‹ã—ã€å½å¿œç”ã®Additional Section ã§æ¯’ãŒå…¥ã‚‹ã¨ã•ã‚ŒãŸã®ã¯èª¤ã‚Šã ã£ãŸã“ã¨ã‚’2011å¹´ã«éˆ´æœ¨ãŒæ˜Žã‹ã«ã—ãŸã€‚ http://www.e-ontap.com/dns/bindmatrix.html MÃ¼ller Bernhard MÃ¼ller ã® "IMPROVED DNS SPOOFING USING NODE RE-DELEGATION", 2008.7.14 https://www.sec-consult.c
terurou 2014/04/16
é€£çµ¡å…ˆã¯endofdns

DNS

security
ãƒªãƒ³ã‚¯
50,000 ãƒ‰ãƒ«ã®ä¾¡å€¤ãŒã‚ã‚‹ Twitter ã‚¢ã‚«ã‚¦ãƒ³ãƒˆãŒç›—ã¾ã‚ŒãŸãã®çµŒç·¯ : ã«ã½ãŸã‚“ç ”ç©¶æ‰€
ã²ã‚ã—ã¾ã•ã‚“ (å»£å³¶ã•ã‚“) ã¯ã€ã“ã‚Œã¾ã§ãŸã£ãŸ 1 æ–‡å—ã® Twitter ã‚¢ã‚«ã‚¦ãƒ³ãƒˆ @N ã‚’æŒã£ã¦ã„ã¾ã—ãŸã€‚ ä½•æ•…ã€ŒæŒã£ã¦ã„ã¾ã—ãŸã€ã¨ã€éŽåŽ»å½¢ãªã®ã‹ã¨ã„ã†ã¨ã€ã©ã†ã‚„ã‚‰å…ˆæ—¥ã€å·§å¦™ãªç½ ã«ã€æœ¬äººã§ã¯ãªã 2 ç¤¾ã®æœ‰å IT é–¢é€£ä¼æ¥ãŒãƒãƒ¡ã‚‰ã‚ŒãŸã“ã¨ã«ã‚ˆã£ã¦ã€ã²ã‚ã—ã¾ã•ã‚“ã®ç¨€å°‘ãªãã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆãŒç¬¬ä¸‰è€…ã«ã‚ˆã£ã¦ç›—ã¾ã‚Œã¦ã—ã¾ã£ãŸãã†ãªã®ã§ã™ã€‚ 2014/02/26 è¿½è¨˜: è¨˜äº‹æŽ²è¼‰æ™‚ç‚¹ã§ã¯ã€ŒæŒã£ã¦ã„ã¾ã—ãŸã€ã¨éŽåŽ»å½¢ã§è¡¨ç¾ã—ã¦ã„ã¾ã™ãŒã€ã²ã‚ã—ã¾ã•ã‚“æœ¬äººã«ã‚ˆã‚‹ãƒ„ã‚¤ãƒ¼ãƒˆã§ã€2014/02/25 ã®æ˜¼éŽãŽ (æ—¥æœ¬æ™‚é–“ 2014/02/26 ã®æ—©æœ) ã«ã€ã“ã®äº‹ä»¶ã«ã‚ˆã£ã¦ç›—ã¾ã‚Œã¦ã—ã¾ã£ãŸã‚¢ã‚«ã‚¦ãƒ³ãƒˆ @N ãŒã‚ˆã†ã‚„ãå–ã‚Šæˆ»ã•ã‚ŒãŸã“ã¨ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚ Order has been restored. â€” Naoki Hiroshima (@N) February 25, 2014 è§£æ±ºã¾ã§ä¸€ãƒ¶æœˆä»¥ä¸Šã¨ã„ã†ç›¸å½“ãª
terurou 2014/01/30
é›»è©±ã‚ªãƒšãƒ¬ãƒ¼ã‚¿ãŒè„†å¼±æ€§

security

PayPal

GoDaddy
ãƒªãƒ³ã‚¯
IE9ä»¥é™ã§ã‚‚HTMLãƒ•ã‚©ãƒ¼ãƒ ã§ãƒ•ã‚¡ã‚¤ãƒ«åã¨ãƒ•ã‚¡ã‚¤ãƒ«ã®ä¸èº«ã‚’å¤–éƒ¨ã‹ã‚‰æŒ‡å®šã§ãã‚‹
æ˜¨æ—¥ã®æ—¥è¨˜ã€ŒIE8ä»¥å‰ã¯HTMLãƒ•ã‚©ãƒ¼ãƒ ã§ãƒ•ã‚¡ã‚¤ãƒ«åã¨ãƒ•ã‚¡ã‚¤ãƒ«ã®ä¸èº«ã‚’å¤–éƒ¨ã‹ã‚‰æŒ‡å®šã§ãã‚‹ã€ã«ã¦ã€ç¦æ£®å¤§å–œã•ã‚“ã‹ã‚‰æ•™ãˆã¦ã„ãŸã ã„ãŸå†…å®¹ã¨ã—ã¦ã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã®HTMLãƒ•ã‚©ãƒ¼ãƒ ï¼ˆenctype="multipart/form-data"ï¼‰ã«ã¦ã€ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã™ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«åã¨ãƒ•ã‚¡ã‚¤ãƒ«ã®ä¸èº«ã‚’å¤–éƒ¨ã‹ã‚‰æŒ‡å®šã§ãã‚‹ã“ã¨ã‚’å ±å‘Šã—ã¾ã—ãŸã€‚ã“ã®éš›ã«IE8ä»¥å‰ã¨ã„ã†æ¡ä»¶ãŒã‚ã‚Šã¾ã—ãŸãŒã€ä»Šåº¦ã¯ã€ä¸‰äº•ç‰©ç”£ã‚»ã‚ãƒ¥ã‚¢ãƒ‡ã‚£ãƒ¬ã‚¯ã‚·ãƒ§ãƒ³ã®æœ›æœˆå²³ã•ã‚“ã‹ã‚‰ã€ã€Œãã‚ŒIE9ä»¥é™ã§ã‚‚ã§ãã‚‹ã‚ˆã€ã¨æ•™ãˆã¦ã„ãŸã ãã¾ã—ãŸã€‚æ—¢ã«ã”å˜ã˜ã ã£ãŸãã†ã§ã™ã€‚ç¦æ£®ã•ã‚“ã€æœ›æœˆã•ã‚“ã¨ã„ã†æ—¥æœ¬ã‚’ä»£è¡¨ã™ã‚‹ãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã‹ã‚‰ã€Œç§˜ä¼ã®ãŸã‚Œã€ã‚’ãŠã™ãã‚ã‘ã„ãŸã ã„ãŸã‚ˆã†ã§ã€èˆˆå¥®æ°—å‘³ã§ã™w ã¾ãšã€ãŠã•ã‚‰ã„ã¨ã—ã¦ã€IE8ä»¥å‰ã§ã®ãƒ‘ã‚¿ãƒ¼ãƒ³ã¯ä¸‹è¨˜ã®é€šã‚Šã§ã—ãŸï¼ˆè¦ç‚¹ã®ã¿ï¼‰ã€‚ <form enctype="multipart/form-data" action="pro_ad
terurou 2014/01/30
ã²ãˆãˆ

IE

security
ãƒªãƒ³ã‚¯
1 2 3 4 5 6 æ¬¡ã®ãƒšãƒ¼ã‚¸