ãã©ãŠã¶æ¡åŒµæ©èœã®ã»ãã¥ãªãã£ãæ·±æãããJavaScriptã®æš©éåæãæœåšçãªãªã¹ã¯ããããŠããå®å šãªãã©ãŠãžã³ã°äœéšã®ããã®ç·©åæŠç¥ã«çŠç¹ãåœãŠãŸãã
ãã©ãŠã¶æ¡åŒµæ©èœã®ã»ãã¥ãªãã£ç£æ»ïŒJavaScriptæš©éåæ
仿¥ã®ããžã¿ã«ç°å¢ã«ãããŠããã©ãŠã¶æ¡åŒµæ©èœã¯ãŠãŒã¶ãŒãšã¯ã¹ããªãšã³ã¹ãšçç£æ§ãåäžãããããã«äžå¯æ¬ ãªããŒã«ãšãªã£ãŠããŸãããã¹ã¯ãŒããããŒãžã£ãŒãåºåãããã«ãŒãããçç£æ§åäžããŒã«ããŠã§ããµã€ãã®ã«ã¹ã¿ãã€ãºããŒã«ãŸã§ããããã®æ¡åŒµæ©èœã¯å¹ åºãæ©èœãæäŸããŸãããããããã®å©äŸ¿æ§ã«ã¯ããŠãŒã¶ãŒããŒã¿ã®ã»ãã¥ãªãã£ãšãã©ã€ãã·ãŒã確ä¿ãããšããé倧ãªè²¬ä»»ã䌎ããŸãããã®éèŠãªåŽé¢ã®äžã€ãããããã®æ¡åŒµæ©èœã«ä»äžãããJavaScriptã®æš©éãçè§£ããåæããããšã§ãã
ãã©ãŠã¶æ¡åŒµæ©èœã®æš©éãçè§£ãã
ãã©ãŠã¶æ¡åŒµæ©èœã¯ããã®æ žå¿ã«ãããŠããŠã§ããã©ãŠã¶ã®æ©èœãæ¡åŒµããå°ããªã¢ããªã±ãŒã·ã§ã³ã§ãããããã¯ããŠã§ãããŒãžã«ã³ãŒãïŒäž»ã«JavaScriptïŒãæ³šå ¥ãããã©ãŠã¶ã®å éšAPIãšå¯Ÿè©±ããããšã§ãããå®çŸããŸããæå³ããã¿ã¹ã¯ãå®è¡ããããã«ãæ¡åŒµæ©èœã¯ããŸããŸãªæš©éãå¿ èŠãšããŸãããããã®æš©éã¯ãæ¡åŒµæ©èœãã¢ã¯ã»ã¹ã§ãããªãœãŒã¹ãšããŒã¿ãèŠå®ããŸããäŸãã°ããã¹ã¯ãŒããããŒãžã£ãŒã¯ãŠãŒã¶ãŒã®èªèšŒæ å ±ãé²èЧ履æŽãžã®ã¢ã¯ã»ã¹ãå¿ èŠã§ãããåºåãããã«ãŒã¯ãŠã§ãããŒãžã®ã³ã³ãã³ãã倿Žããæš©éãå¿ èŠã§ãã
ãããã®æš©éã¯åºç¯ã«åé¡ãããŠãããæ¡åŒµæ©èœãèŠæ±ããç¹å®ã®æš©éã¯ããã®æœåšçãªã»ãã¥ãªãã£ãªã¹ã¯ã倿ããäžã§æ¥µããŠéèŠã§ããçŸä»£ã®ãã©ãŠã¶ã®æš©éã¢ãã«ã¯ãäžè¬çã«æ¡åŒµæ©èœãã§ããããšã®ç¯å²ãå¶éããããã«èšèšãããŠããŸãããäžå šã§ã¯ãããŸãããæš©éã·ã¹ãã ã¯ãæ¬è³ªçã«ãæå³ããã¿ã¹ã¯ãå®è¡ããããã«æ¡åŒµæ©èœã«å¯èœãªéãå°ãªãæš©éãä»äžããããšã§ãæ©èœæ§ãšã»ãã¥ãªãã£ã®ãã©ã³ã¹ãåãããšããŸããäžè¬çãªæš©éã«ã¯ä»¥äžã®ãããªãã®ããããŸãïŒ
- é²èЧ履æŽãžã®ã¢ã¯ã»ã¹ïŒ æ¡åŒµæ©èœããŠãŒã¶ãŒã®é²èЧ履æŽãèªã¿åããæã«ã¯å€æŽããããšãèš±å¯ããŸããããã¯æ€çŽ¢åè£ã®æäŸãšãã£ãæ£åœãªç®çã«ãããŠãŒã¶ãŒè¡åã®è¿œè·¡ãšãã£ãæªæã®ããæŽ»åã«ã䜿çšãããå¯èœæ§ããããŸãã
- ãŠã§ããµã€ãã³ã³ãã³ããžã®ã¢ã¯ã»ã¹ïŒ ãŠã§ãããŒãžãžã®ã³ãŒãã®èªã¿åãã倿ŽããããŠæã«ã¯æ³šå ¥ãèš±å¯ããŸããããã¯åºåãããã«ãŒãã³ã³ãã³ããšã³ãã³ãµãŒããŠã§ããµã€ãã®ãŠãŒã¶ãŒã€ã³ã¿ãŒãã§ãŒã¹ã倿ŽããããŒã«ã«ãšã£ãŠäžå¯æ¬ ã§ããããããããã¯æªæã®ããæ¡åŒµæ©èœã«ãšã£ãŠã®æœåšçãªæ»æå¯Ÿè±¡é åãçã¿åºããŸãã
- Cookieãžã®ã¢ã¯ã»ã¹ïŒ æ¡åŒµæ©èœãCookieã®èªã¿åããæžã蟌ã¿ããããŠæã«ã¯åé€ãå¯èœã«ããŸããããã¯èªèšŒãã»ãã·ã§ã³ç®¡çã«ãã°ãã°å¿ èŠã§ãããæœåšçãªã»ãã·ã§ã³ãã€ãžã£ãã¯ãã¯ãã¹ãµã€ãã¹ã¯ãªããã£ã³ã°ïŒXSSïŒæ»æãžã®æãéããŸãã
- ããŒã¿ã¹ãã¬ãŒãžãžã®ã¢ã¯ã»ã¹ïŒ æ¡åŒµæ©èœãããŒã«ã«ã¹ãã¬ãŒãžã«ã¢ã¯ã»ã¹ã§ããããã«ããããã«èšå®ãç°å¢èšå®ãå Žåã«ãã£ãŠã¯æ©å¯æ å ±ãªã©ã®ãŠãŒã¶ãŒããŒã¿ãä¿åã§ããŸããå®å šã§ãªãã¹ãã¬ãŒãžã¯ããŒã¿äŸµå®³ã«ã€ãªããå¯èœæ§ããããŸãã
- ãããã¯ãŒãã³ã°ãžã®ã¢ã¯ã»ã¹ïŒäŸïŒXMLHttpRequestïŒïŒ æ¡åŒµæ©èœããããã¯ãŒã¯ãªã¯ãšã¹ããè¡ãããšãèš±å¯ããå€éšãµãŒããŒãšã®éä¿¡ãå¯èœã«ããŸãããã®æ©èœã¯ãæŽæ°ã®ååŸãã³ã³ãã³ãã®æäŸããŠã§ããµãŒãã¹ãšã®çµ±åãªã©ã®æ©èœã«ãšã£ãŠéèŠã§ãããããŒã¿çªåãã³ãã³ãïŒã³ã³ãããŒã«æäœã®ããã«æªçšãããå¯èœæ§ããããŸãã
- ã¿ããšãŠã£ã³ããŠãžã®ã¢ã¯ã»ã¹ïŒ æ¡åŒµæ©èœããã©ãŠã¶ã®ã¿ãããŠã£ã³ããŠãšå¯Ÿè©±ã§ããããã«ããæ°ããã¿ããéããã¿ããéãããã¿ãã®ã³ã³ãã³ãã倿Žãããªã©ã®ã¿ã¹ã¯ã«äœ¿çšã§ããŸãã
- ãã¹ã¯ãããæ©èœãžã®ã¢ã¯ã»ã¹ïŒ ã«ã¡ã©ããã€ã¯ãäœçœ®æ å ±ãªã©ãããã€ã¹ã®æ©èœãžã®ã¢ã¯ã»ã¹ãèš±å¯ããããšãã§ããŸãããããã®æ©èœã¯éåžžã«æ©å¯æ§ãé«ããæå€§éã®æ³šæãå¿ èŠã§ãã
äŸïŒ ãã¹ã¯ãŒããããŒãžã£ãŒæ¡åŒµæ©èœãèããŠã¿ãŸããããããã«ã¯ä»¥äžã®æš©éãå¿ èŠã§ãïŒ
- ãŠãŒã¶ãŒã®ãã©ãŠã¶å±¥æŽã®èªã¿åããšæžã蟌ã¿ïŒãŠã§ããµã€ãã®ãã°ã€ã³ã远跡ããããïŒã
- ãŠã§ããµã€ãã³ã³ãã³ããžã®ã¢ã¯ã»ã¹ïŒãã°ã€ã³ãã©ãŒã ãæ€åºããèªèšŒæ å ±ãå ¥åããããïŒã
- Cookieãžã®ã¢ã¯ã»ã¹ïŒç°ãªããŠã§ããµã€ãéã§ãã°ã€ã³ã»ãã·ã§ã³ãç¶æããããïŒã
- ããŒã«ã«ã¹ãã¬ãŒãžãžã®ã¢ã¯ã»ã¹ïŒãŠãŒã¶ãŒã®èªèšŒæ å ±ãä¿åããããïŒã
æ¡åŒµæ©èœã»ãã¥ãªãã£ã«ãããJavaScriptã®åœ¹å²
JavaScriptã¯ãã©ãŠã¶æ¡åŒµæ©èœã®åååã§ããããã¯ãã³ã¢æ©èœã®å®è£ ããã©ãŠã¶APIãšã®å¯Ÿè©±ããŠã§ãããŒãžã®ã³ã³ãã³ãæäœã«äœ¿çšãããèšèªã§ããæ¡åŒµæ©èœå ã®JavaScriptã³ãŒãããã®æ¯ãèããšåŠçããããŒã¿ã決å®ããŸãããããã£ãŠãJavaScriptã³ãŒãã®å質ãšã»ãã¥ãªãã£ã¯ãæ¡åŒµæ©èœå šäœã®ã»ãã¥ãªãã£äœå¶ã«çŽæ¥åœ±é¿ããŸãã
JavaScriptã®è匱æ§ã¯ããã©ãŠã¶æ¡åŒµæ©èœã®ã»ãã¥ãªãã£åé¡ã®äž»ãªåå ã§ãããããã®è匱æ§ã¯ã以äžã®ãããªããŸããŸãªåå ããçããå¯èœæ§ããããŸãïŒ
- äžé©åãªã³ãŒãã£ã³ã°æ £è¡ïŒ æ¡åŒµæ©èœãã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ã«ååãªæ³šæãæããã«éçºãããããšããããŸããããã¯ãã¯ãã¹ãµã€ãã¹ã¯ãªããã£ã³ã°ïŒXSSïŒãã¯ãã¹ãµã€ããªã¯ãšã¹ããã©ãŒãžã§ãªïŒCSRFïŒãSQLã€ã³ãžã§ã¯ã·ã§ã³ïŒæ¡åŒµæ©èœããµãŒããŒãµã€ãã®ããŒã¿ããŒã¹ãšå¯Ÿè©±ããå ŽåïŒãªã©ã®äžè¬çãªè匱æ§ã«ã€ãªããå¯èœæ§ããããŸãã
- è匱ãªã©ã€ãã©ãªã®äœ¿çšïŒ å€ãã®æ¡åŒµæ©èœã¯ããµãŒãããŒãã£ã®JavaScriptã©ã€ãã©ãªããã¬ãŒã ã¯ãŒã¯ãå©çšããŠããŸãããããã®ã©ã€ãã©ãªã«æ¢ç¥ã®è匱æ§ãå«ãŸããŠããå Žåãæ¡åŒµæ©èœã¯ãããã®è匱æ§ãç¶æ¿ããæªçšã®å¯Ÿè±¡ãšãªããŸãããããç·©åããããã«ã¯ãäŸåé¢ä¿ãææ°ã®ç¶æ ã«ä¿ã€ããšãç¶ç¶çãªã¿ã¹ã¯ã§ãã
- å®å šã§ãªããŠãŒã¶ãŒå ¥åã®åŠçïŒ æ¡åŒµæ©èœãé©åãªãµãã¿ã€ãºãæ€èšŒãªãã«ãŠãŒã¶ãŒå ¥åãåŠçãããšãã€ã³ãžã§ã¯ã·ã§ã³æ»æã«å¯ŸããŠè匱ã«ãªãå¯èœæ§ããããŸãã
- è匱ãªèªèšŒãšèªå¯ïŒ ãŠãŒã¶ãŒããŒã¿ãä¿åãããããªã¢ãŒããµãŒããŒãšå¯Ÿè©±ãããããæ¡åŒµæ©èœã«ãããŠãèªèšŒã¡ã«ããºã ãè匱ã§ãããšããŠãŒã¶ãŒã¢ã«ãŠã³ããäžæ£ã¢ã¯ã»ã¹ã«æãããå¯èœæ§ããããŸãã
- å®å šã§ãªãããŒã¿ã¹ãã¬ãŒãžïŒ æ©å¯ããŒã¿ïŒäŸïŒãã¹ã¯ãŒããAPIããŒïŒãããŒã«ã«ã¹ãã¬ãŒãžããã®ä»ã®ä¿è·ãããŠããªãå Žæã«ä¿åãããšãé倧ãªãªã¹ã¯ãçã¿åºãå¯èœæ§ããããŸãã
- ããžãã¯ã®æ¬ é¥ïŒ äžæ£ç¢ºãªã¢ã¯ã»ã¹å¶åŸ¡ãäºæããªãæ¯ãèããªã©ãæ¡åŒµæ©èœã®ããžãã¯ã«ããããšã©ãŒã¯ãã»ãã¥ãªãã£äŸµå®³ã«ã€ãªããå¯èœæ§ããããŸãã
äŸïŒ è匱æ§ã®äžäŸãšããŠãæ¡åŒµæ©èœãåäœãããŠã§ããµã€ãããåãåã£ãããŒã¿ãé©åã«æ€èšŒããªãå ŽåããããŸããããã«ããã䟵害ããããŠã§ããµã€ãããæªæã®ããJavaScriptã³ãŒããå®è¡ãããå¯èœæ§ããããŸãã
JavaScriptæš©éåæïŒæ·±æã
JavaScriptæš©éåæãšã¯ããã©ãŠã¶æ¡åŒµæ©èœå ã®JavaScriptã³ãŒããäœç³»çã«èª¿æ»ãããããèŠæ±ããæš©éãåŠçããããŒã¿ãããã³æœåšçãªã»ãã¥ãªãã£è匱æ§ãç¹å®ããããã»ã¹ã§ãããã®åæã¯ãæ¡åŒµæ©èœã®ã»ãã¥ãªãã£ãããã¡ã€ã«ãçè§£ããé¢é£ãããªã¹ã¯ãè©äŸ¡ããããã«äžå¯æ¬ ã§ãã
ãã®ããã»ã¹ã¯éåžžã以äžã®ã¹ããããå«ã¿ãŸãïŒ
- æ¡åŒµæ©èœã³ãŒãã®ååŸïŒ æåã®ã¹ãããã¯ãæ¡åŒµæ©èœã®ãœãŒã¹ã³ãŒããååŸããããšã§ããããã¯ããã©ãŠã¶ã®æ¡åŒµæ©èœã¹ãã¢ããçŽæ¥æ¡åŒµæ©èœãã¡ã€ã«ãããŠã³ããŒããããããã©ãŠã¶å ã«ã€ã³ã¹ããŒã«ãããæ¡åŒµæ©èœããã³ãŒããæœåºããããšã§è¡ããŸããäžéšã®ãã©ãŠã¶ã¯ãããã容æã«ããããŒã«ãæ¡åŒµæ©èœãæäŸããŠãããã€ã³ã¹ããŒã«ãããæ¡åŒµæ©èœã®ç°¡åãªæ€æ»ãå¯èœã«ããŠããŸãã
- ã³ãŒãã¬ãã¥ãŒãšéçè§£æïŒ ã³ãŒããå ¥æã§ããããã»ãã¥ãªãã£ã¢ããªã¹ãã¯ã³ãŒãã¬ãã¥ãŒãè¡ããJavaScriptã³ãŒããæåã§èª¿ã¹ãŠæœåšçãªè匱æ§ãç¹å®ããŸããã³ãŒããå®è¡ããã«èªåçã«åæããéçè§£æããŒã«ãããã®ããã»ã¹ãæ¯æŽããŸãããããã®ããŒã«ã¯ãã€ã³ãžã§ã¯ã·ã§ã³è匱æ§ãå®å šã§ãªãã³ãŒãã£ã³ã°ãã¿ãŒã³ãæ¢ç¥ã®è匱ãªã©ã€ãã©ãªã®äœ¿çšãªã©ãäžè¬çãªã»ãã¥ãªãã£äžã®æ¬ é¥ãæ¢ããŸãã
- åçè§£æãšãã¹ãïŒ åçè§£æã§ã¯ãæ¡åŒµæ©èœãå¶åŸ¡ãããç°å¢ïŒä»®æ³ãã·ã³ããµã³ãããã¯ã¹åããããã©ãŠã¶ã€ã³ã¹ã¿ã³ã¹ãªã©ïŒã§å®è¡ãããã®æ¯ãèãã芳å¯ããŸããããã«ãããããŒã¿åŠçãå ¥åæ€èšŒãå€éšãµãŒãã¹ãšã®å¯Ÿè©±ã«é¢é£ããåé¡ãªã©ãéçè§£æã§ã¯æããã«ãªããªãè匱æ§ãç¹å®ããã®ã«åœ¹ç«ã¡ãŸããããŸããŸãªå ¥åãšç°ãªãã·ããªãªã§æ¡åŒµæ©èœããã¹ãããããšã¯ãé ããæ¬ é¥ãçºèŠããããã«äžå¯æ¬ ã§ãã
- æš©éã®æ€èšŒïŒ æ¡åŒµæ©èœãèŠæ±ããæš©éãæå®ãããããã§ã¹ããã¡ã€ã«ãæ³šææ·±ãåæããŸããèŠæ±ãããæš©éãæ¡åŒµæ©èœã®æå³ããæ©èœãšäžèŽããŠããããšã確èªããŸããäžèŠãŸãã¯é床ã«åºç¯ãªæš©éã¯å±éºä¿¡å·ã§ããããããªã調æ»ãå¿ èŠã§ãã
- ããŒã¿ãããŒåæïŒ æ¡åŒµæ©èœå ã®ããŒã¿ã®æµãã远跡ããæ©å¯ããŒã¿ãã©ãã§åŠçãããã©ã®ããã«å å·¥ãããã©ãã«ä¿åãããããç¹å®ããŸããããã¯ãããŒã¿äŸµå®³ãäžæ£ã¢ã¯ã»ã¹ã®ãªã¹ã¯ãè©äŸ¡ããã®ã«åœ¹ç«ã¡ãŸãã
- äŸåé¢ä¿åæïŒ æ¡åŒµæ©èœã䜿çšãããµãŒãããŒãã£ã®ã©ã€ãã©ãªããã¬ãŒã ã¯ãŒã¯ãç¹å®ããŸãããããã®äŸåé¢ä¿ãææ°ã§ãããæ¢ç¥ã®è匱æ§ããªãããšã確èªããŸãã
- è匱æ§è©äŸ¡ãšå ±åïŒ åæã«åºã¥ããŠãè匱æ§ãç¹å®ãããã®æ·±å»åºŠã«å¿ããŠã©ã³ã¯ä»ãããŸããç¹å®ãããè匱æ§ããã®æœåšçãªåœ±é¿ãããã³ç·©åçã®æšå¥šäºé ãå«ã詳现ãªã¬ããŒãã«èª¿æ»çµæãææžåããŸãã
ã·ããªãªäŸïŒ ããæ¡åŒµæ©èœããåã«ãŠã§ãããŒãžã®èæ¯è²ã倿Žãããšäž»åŒµããŠãããšããŸãããããããã¹ãŠã®ãŠã§ããµã€ãããŒã¿ãžã®ã¢ã¯ã»ã¹ãšãããã¯ãŒã¯ãªã¯ãšã¹ããè¡ãæš©éãèŠæ±ããŠããŸãããã®äžäžèŽã¯ããªããããã®éå°ãªæš©éãå¿ èŠãªã®ãã倿ããããã«ãæ¡åŒµæ©èœã®ã³ãŒãã詳ãã調ã¹ãå¿ èŠããããŸãããã®æ¡åŒµæ©èœã¯ãç§å¯è£ã«ãŠãŒã¶ãŒããŒã¿ãåéããããå€éšãµãŒããŒãšéä¿¡ãããããŠããã®ã§ããããïŒ
JavaScriptæš©éåæã®ããã®ããŒã«ãšãã¯ããã¯
JavaScriptæš©éåæã®ããã»ã¹ãæ¯æŽããããã€ãã®ããŒã«ããã¯ããã¯ããããŸãããããã¯æåã®ã³ãŒãã¬ãã¥ãŒãããèªååãããéçã»åçè§£æããŒã«ãŸã§å€å²ã«ããããŸãã
- æåã³ãŒãã¬ãã¥ãŒïŒ ããã¯ããããã»ãã¥ãªãã£ç£æ»ã®åºç€ã§ããæ¡åŒµæ©èœã®ãœãŒã¹ã³ãŒããæ³šææ·±ã調ã¹ãè匱æ§ãæ¢ããæ¡åŒµæ©èœã®æ©èœãçè§£ããããšãå«ã¿ãŸããããã«ã¯ãJavaScriptããŠã§ãã»ãã¥ãªãã£ã®ååãããã³äžè¬çãªæ»æãã¯ãã«ã«é¢ããæ·±ãçè§£ãå¿ èŠã§ãã
- éçè§£æããŒã«ïŒ ãããã®ããŒã«ã¯ãã³ãŒããå®è¡ããã«èªåçã«åæããäžè¬çãªã»ãã¥ãªãã£äžã®æ¬ é¥ãã³ãŒãå質ã®åé¡ãæœåšçãªè匱æ§ãæ¢ããŸããäŸãšããŠã¯ãã»ãã¥ãªãã£ãã©ã°ã€ã³ãåããeslintãSonarQubeããŠã§ãã¢ããªã±ãŒã·ã§ã³åãã«èšèšãããå°éã®éçè§£æããŒã«ãªã©ããããŸãããããã¯è匱æ§ã®çºèŠãèªååã§ããŸãã
- åçè§£æããŒã«ïŒ ãããã®ããŒã«ã¯ãæ¡åŒµæ©èœãå¶åŸ¡ãããç°å¢ã§å®è¡ãããã®æ¯ãèãã芳å¯ããŸããããŒã¿åŠçãå€éšãµãŒãã¹ãšã®å¯Ÿè©±ã«é¢é£ããåé¡ãªã©ãéçè§£æã§ã¯æããã«ãªããªãè匱æ§ãç¹å®ããã®ã«åœ¹ç«ã¡ãŸãããã©ãŠã¶ã®éçºè ããŒã«ïŒäŸïŒChrome DevToolsãFirefox Developer ToolsïŒã¯ããã®ç®çã§éåžžã«æçšã§ãã
- ãµã³ãããã¯ã¹åïŒ æ¡åŒµæ©èœãä»®æ³ãã·ã³ããããã¯ãŒã¯ã¢ã¯ã»ã¹ãå¶éãããã©ãŠã¶ãããã¡ã€ã«ãªã©ã®ãµã³ãããã¯ã¹ç°å¢ã§å®è¡ããããšã§ãæ¡åŒµæ©èœãéé¢ãããã¹ãã·ã¹ãã ã«å®³ãåãŒãã®ãé²ãã®ã«åœ¹ç«ã¡ãŸããããã«ãããè匱æ§ã®æœåšçãªåœ±é¿ãéå®ãããæ¡åŒµæ©èœã®æ¯ãèããããå®å šã«ãã¹ãã§ããŸãã
- ãã©ãŠã¶éçºè ããŒã«ïŒ ãŠã§ããã©ãŠã¶ã«çµã¿èŸŒãŸããŠããéçºè ããŒã«ã¯ãJavaScriptã³ãŒãã®æ€æ»ããããã°ãåæã«åœ¹ç«ã€è²Žéãªæ©èœãæäŸããŸãããããã®ããŒã«ã䜿çšãããšãæ¡åŒµæ©èœã®ã³ãŒããæ€æ»ãããã¬ãŒã¯ãã€ã³ããèšå®ãããããã¯ãŒã¯ãªã¯ãšã¹ããç£èŠã§ãããããæ¡åŒµæ©èœã®ä»çµã¿ãçè§£ããæœåšçãªè匱æ§ãç¹å®ããã®ã«åœ¹ç«ã¡ãŸãã
- äŸµå ¥ãã¹ãïŒ äŸµå ¥ãã¹ãïŒã·ãã¥ã¬ãŒããããæ»æïŒãå®è¡ããããšã§ãä»ã®æ¹æ³ã§ã¯èŠã€ãããªãå¯èœæ§ã®ããè匱æ§ãæããã«ããããšãã§ããŸããããã«ã¯ãç¹å®ããã匱ç¹ãæªçšããŠäžæ£ãªã¢ã¯ã»ã¹ãå¶åŸ¡ãåŸãããšè©Šã¿ãããšãå«ãŸããŸãã
äŸïŒ äŸµå ¥ãã¹ã¿ãŒã¯ãã¯ãã¹ãµã€ãã¹ã¯ãªããã£ã³ã°ïŒXSSïŒè匱æ§ãä»ããŠãæ¡åŒµæ©èœã®ã³ãŒãã«æªæã®ããJavaScriptã³ãŒããæ³šå ¥ããããšè©Šã¿ããããããŸããããã¹ã¿ãŒã¯ãè匱æ§ã®åœ±é¿ãçºèŠããããã«ããããææ®µã詊ã¿ãŸãã
ãã©ãŠã¶æ¡åŒµæ©èœãç£æ»ããããã®ãã¹ããã©ã¯ãã£ã¹
培åºçãªã»ãã¥ãªãã£ç£æ»ã宿œããã«ã¯ãç¹å®ã®ãã¹ããã©ã¯ãã£ã¹ã«åŸãå¿ èŠããããŸãã以äžã«ããã€ãã®äž»èŠãªæšå¥šäºé ã瀺ããŸãïŒ
- ãããã§ã¹ãããå§ããïŒ åæã¯ãæ¡åŒµæ©èœã®ãããã§ã¹ããã¡ã€ã«ãæ³šææ·±ã調ã¹ãããšããå§ããŸãããã®ãã¡ã€ã«ã¯ãæ¡åŒµæ©èœã®æš©éãå«ãŸãããã¡ã€ã«ãããã³å šäœçãªæ§æãå®çŸ©ããŸãããããã§ã¹ããçè§£ããããšã¯ãæ¡åŒµæ©èœã®æœåšçãªã»ãã¥ãªãã£ãªã¹ã¯ãè©äŸ¡ããããã«äžå¯æ¬ ã§ãã
- æ¡åŒµæ©èœã®ç®çãçè§£ããïŒ ç£æ»ãå§ããåã«ãæ¡åŒµæ©èœã®æå³ãããæ©èœãå®å šã«çè§£ããŠãã ãããããã«ãããèŠæ±ãããæš©éã®å¿ èŠæ§ãè©äŸ¡ããçãããæ¯ãèããç¹å®ããã®ã«åœ¹ç«ã¡ãŸãã
- ã»ãã¥ãªãã£ãåªå ããïŒ ã»ãã¥ãªãã£ç¬¬äžã®èãæ¹ã§ç£æ»ã«èšãã§ãã ãããæ¡åŒµæ©èœã«è匱æ§ãå«ãŸããŠããå¯èœæ§ããããšæ³å®ããç©æ¥µçã«ããããæ¢ããŠãã ããã
- å¯èœãªéãèªååããïŒ éçããã³åçè§£æããŒã«ã䜿çšããŠãè匱æ§ãç¹å®ããããã»ã¹ãèªååããŸããèªååã«ããæéãç¯çŽããããã»ã¹ã®æ©ã段éã§æœåšçãªåé¡ãç¹å®ããã®ã«åœ¹ç«ã¡ãŸãã
- çŸå®çãªç°å¢ã§ãã¹ãããïŒ æ¡åŒµæ©èœã®æ¯ãèããšæœåšçãªãªã¹ã¯ãæ£ç¢ºã«è©äŸ¡ããããã«ãæ¬çªç°å¢ã«è¿ããã©ãŠã¶ãããã¡ã€ã«ããµã³ãããã¯ã¹ç°å¢ãªã©ãçŸå®çãªç°å¢ã§æ¡åŒµæ©èœããã¹ãããŠãã ããã
- 宿çã«ã¬ãã¥ãŒãšæŽæ°ãè¡ãïŒ ã»ãã¥ãªãã£ç£æ»ã¯äžåºŠããã®ã¿ã¹ã¯ã§ã¯ãããŸãããä»ã®ãœãããŠã§ã¢ãšåæ§ã«ãæ¡åŒµæ©èœã宿çã«ã¬ãã¥ãŒããã³æŽæ°ããŠãç¹å®ãããè匱æ§ã«å¯ŸåŠããæ°ããã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ãåãå ¥ããå¿ èŠããããŸãã
- ãµãŒãããŒãã£ã®äŸåé¢ä¿ãç£èŠããïŒ æ¡åŒµæ©èœã®ãµãŒãããŒãã£ã®äŸåé¢ä¿ã«æ¢ç¥ã®è匱æ§ããªãã宿çã«ç¢ºèªããããããææ°ã§ããããšã確èªããŠãã ãããäŸåé¢ä¿ã®è匱æ§ã¯é倧ãªãªã¹ã¯ããããããŸãã
- ãã¹ãŠãææžåããïŒ ç¹å®ãããè匱æ§ããã®æœåšçãªåœ±é¿ãããã³ç·©åçã®æšå¥šäºé ãå«ãã調æ»çµæã培åºçã«ææžåããŠãã ããããã®ææžã¯ãé²æç¶æ³ã远跡ããè匱æ§ã確å®ã«å¯ŸåŠãããããã«ããããã«äžå¯æ¬ ã§ãã
- ã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ã«é¢ããææ°æ å ±ãå ¥æããïŒ ãŠã§ãã»ãã¥ãªãã£ã®ç¶æ³ã¯çµ¶ããå€åããŠããŸããå®å šãªãã©ãŠã¶æ¡åŒµæ©èœãæ§ç¯ããããã®ææ°ã®ã»ãã¥ãªãã£è åšãè匱æ§ããã¹ããã©ã¯ãã£ã¹ã«ã€ããŠææ°ã®æ å ±ãå ¥æããããšãéèŠã§ãã
- å°éçãªã»ãã¥ãªãã£ç£æ»ãæ€èšããïŒ éèŠãªæ¡åŒµæ©èœãæ©å¯ããŒã¿ãæ±ãæ¡åŒµæ©èœã«ã€ããŠã¯ãå°éã®ã»ãã¥ãªãã£äŒç€Ÿã«ç¬ç«ããç£æ»ãäŸé Œããããšãæ€èšããŠãã ãããå°éå®¶ã«ããè©äŸ¡ã¯ãæ¡åŒµæ©èœã®ã»ãã¥ãªãã£äœå¶ãå€§å¹ ã«åŒ·åããããšãã§ããŸãã
äŸïŒ ãã¹ã¯ãŒããããŒãžã£ãŒã®å Žåãã»ãã¥ãªãã£ç£æ»ã«ã¯ããã¹ãŠã®èªèšŒããã³ã¹ãã¬ãŒãžã¡ãœããã®ãã¹ãããªãã³ã«æ¡åŒµæ©èœã䜿çšããéä¿¡ãã£ãã«ã®ã»ãã¥ãªãã£ã®ãã¹ããå«ãŸããã¹ãã§ãã
ãªã¹ã¯ã®è»œæžïŒåãã¹ãè¡å
è匱æ§ãç¹å®ãããããé¢é£ãããªã¹ã¯ã軜æžããããã®æªçœ®ãè¬ããããšãéèŠã§ãã以äžã«æ€èšãã¹ãè¡åãããã€ã瀺ããŸãïŒ
- æš©éãåæžããïŒ å¿ èŠæå°éã®æš©éã®ã¿ãèŠæ±ããŸããæ¡åŒµæ©èœã®æ©èœã«äžå¯æ¬ ã§ãªãæš©éã¯ãã¹ãŠåé€ããŠãã ããã
- å ¥åãæ€èšŒããã³ãµãã¿ã€ãºããïŒ XSSãSQLã€ã³ãžã§ã¯ã·ã§ã³ãªã©ã®ã€ã³ãžã§ã¯ã·ã§ã³æ»æãé²ãããã«ããã¹ãŠã®ãŠãŒã¶ãŒå ¥åãæ³šææ·±ãæ€èšŒããã³ãµãã¿ã€ãºããŠãã ããã
- æ©å¯ããŒã¿ãå®å šã«ä¿åããïŒ æ¡åŒµæ©èœãæ©å¯ããŒã¿ãä¿åããå Žåã¯ãæå·åãªã©ã®å®å šãªã¹ãã¬ãŒãžã¡ã«ããºã ã䜿çšããŠãäžæ£ã¢ã¯ã»ã¹ããä¿è·ããŠãã ããã
- é©åãªèªèšŒãšèªå¯ãå®è£ ããïŒ æ¡åŒµæ©èœã®æ©èœãžã®ã¢ã¯ã»ã¹ãå¶åŸ¡ããããã«ãå ç¢ãªèªèšŒããã³èªå¯ã¡ã«ããºã ãå®è£ ããŠãã ããã
- å®å šãªã³ãŒãã£ã³ã°æ £è¡ã䜿çšããïŒ å®å šã§ãªãã³ãŒãã£ã³ã°ãã¿ãŒã³ãé¿ããäŸåé¢ä¿ãææ°ã«ä¿ã¡ã確ç«ãããã»ãã¥ãªãã£ãã¬ãŒã ã¯ãŒã¯ã䜿çšãããªã©ãå®å šãªã³ãŒãã£ã³ã°æ £è¡ãéµå®ããŠãã ããã
- æ¡åŒµæ©èœã宿çã«æŽæ°ããïŒ ç¹å®ãããè匱æ§ã«å¯ŸåŠããæ°ããã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ãåãå ¥ããããã«ãæ¡åŒµæ©èœã宿çã«æŽæ°ããŠãã ããã
- ã³ã³ãã³ãã»ãã¥ãªãã£ããªã·ãŒïŒCSPïŒãå®è£ ããïŒ æ¡åŒµæ©èœãããŒãã§ãããªãœãŒã¹ãå¶éããããã«ã³ã³ãã³ãã»ãã¥ãªãã£ããªã·ãŒïŒCSPïŒãå®è£ ããXSSããã®ä»ã®æ»æã®ãªã¹ã¯ã軜æžããã®ã«åœ¹ç«ãŠãŠãã ããã
- 峿 ŒãªCSPãå®è£ ããïŒ CSPã峿 Œã§ããã°ããã»ã©è¯ãã§ããå¶éã®å°ãªãCSPããªã·ãŒã¯ãäŸç¶ãšããŠäŸµå®³ã®äœå°ãæ®ãå¯èœæ§ããããŸãã
- ã»ãã¥ãªãã£è åšãç£èŠããïŒ æ¡åŒµæ©èœã®ã»ãã¥ãªãã£è åšãç¶ç¶çã«ç£èŠããŸããçãããæŽ»åãæ€åºããŠå¯Ÿå¿ããããã«ããã®ã³ã°ããã³ã¢ã©ãŒãã¡ã«ããºã ãå®è£ ããŠãã ããã
- ãŠãŒã¶ãŒãæè²ããïŒ ãã©ãŠã¶æ¡åŒµæ©èœã«é¢é£ããã»ãã¥ãªãã£ãªã¹ã¯ãšãä¿¡é Œã§ãããœãŒã¹ããæ¡åŒµæ©èœãéžæããããšã®éèŠæ§ã«ã€ããŠãŠãŒã¶ãŒãæè²ããŸããæ¡åŒµæ©èœãæ±ããæš©éãçè§£ããæå©ããããŠãã ããã
äŸïŒ éçºè ã¯ãã¯ãã¹ãµã€ãã¹ã¯ãªããã£ã³ã°ïŒXSSïŒæ»æãé²ãããã«ãã¹ãŠã®ãŠãŒã¶ãŒå ¥åããµãã¿ã€ãºããæ¡åŒµæ©èœã®ã»ãã¥ãªãã£ãããã«åŒ·åããããã«å³æ Œãªã³ã³ãã³ãã»ãã¥ãªãã£ããªã·ãŒïŒCSPïŒãå®è£ ããããšãã§ããŸãã
ããžã¿ã«æä»£ã«ããããã©ãŠã¶ã»ãã¥ãªãã£ã®éèŠæ§
仿¥ã®ããžã¿ã«æä»£ã«ãããŠããã©ãŠã¶ã®ã»ãã¥ãªãã£ã¯æãéèŠã§ãããã©ãŠã¶ã¯ã€ã³ã¿ãŒããããžã®äž»èŠãªã²ãŒããŠã§ã€ã§ãããå人æ å ±ã財å詳现ãé²èЧ履æŽãªã©ãèšå€§ãªéã®æ©å¯ããŒã¿ãæ±ããŸãããã©ãŠã¶æ¡åŒµæ©èœã®ã»ãã¥ãªãã£ç¢ºä¿ã¯ããã®åºç¯ãªã»ãã¥ãªãã£æŠç¥ã®äžå¯æ¬ ãªéšåã§ãã
ãŠã§ãã¢ããªã±ãŒã·ã§ã³ããªã³ã©ã€ã³ãµãŒãã¹ãžã®äŸå床ãé«ãŸãã«ã€ããŠããã©ãŠã¶ããŒã¹ã®æ»æã«é¢é£ãããªã¹ã¯ãå¢å€§ããŠããŸãããã«ãŠã§ã¢ããã£ãã·ã³ã°æ»æãããŒã¿äŸµå®³ã¯å€§ããªè åšã§ãããã©ãŠã¶æ¡åŒµæ©èœã¯ããã«ãŠã§ã¢ãé åžããããŠãŒã¶ãŒããŒã¿ãçãã ãããææ®µãšããŠæªçšãããå¯èœæ§ããããŸãããããã£ãŠããŠãŒã¶ãŒãšãã®ããŒã¿ãä¿è·ããããã«ã¯ããã©ãŠã¶ã»ãã¥ãªãã£ãžã®ç©æ¥µçãªã¢ãããŒããäžå¯æ¬ ã§ãã
培åºçãªã»ãã¥ãªãã£ç£æ»ã宿œãããã¹ããã©ã¯ãã£ã¹ãå®è£ ãããªã¹ã¯ã«ã€ããŠãŠãŒã¶ãŒãæè²ããããšã§ããã©ãŠã¶ã®ã»ãã¥ãªãã£ãå€§å¹ ã«åäžããããã¹ãŠã®äººã«ãšã£ãŠããå®å šãªãªã³ã©ã€ã³ç°å¢ãäœãåºãããšãã§ããŸããããã¯ãéçºè ããã©ãŠã¶ãã³ããŒãã»ãã¥ãªãã£ç ç©¶è ããããŠãŠãŒã¶ãŒãé¢ããå ±æã®è²¬ä»»ã§ãããã®ååãããã¹ãŠã®äººã«ãšã£ãŠããå®å šãªããžã¿ã«äœéšãè²ã¿ãŸãã
åœéçãªèŠç¹ïŒ ãã©ãŠã¶ã»ãã¥ãªãã£ã®å®è·µã«é¢ããèªèã¯ãåœãæåã«ãã£ãŠå€§ããç°ãªããŸããäžéšã®å°åã§ã¯ããŠãŒã¶ãŒããã©ãŠã¶æ¡åŒµæ©èœã«é¢é£ããã»ãã¥ãªãã£ãªã¹ã¯ã«ã€ããŠååã«ç¥ããããŠããªãå ŽåããããŸãããããã£ãŠãäžççã«ãã©ãŠã¶ã»ãã¥ãªãã£ã®æèãä¿é²ããããã«ãããŒã«ã©ã€ãºãããæè²ããªãœãŒã¹ãæäŸããããšãéèŠã§ããè€æ°ã®èšèªã§æ å ±ãæäŸããããšã¯ããã®æ¹åãžã®æçœãªäžæ©ãšãªãã§ãããã
çµè«
ãã©ãŠã¶æ¡åŒµæ©èœã®ã»ãã¥ãªãã£ã¯ããŠã§ãå šäœã®ã»ãã¥ãªãã£ã«ãããŠéèŠãªåŽé¢ã§ããJavaScriptæš©éåæã¯ãæœåšçãªè匱æ§ãç¹å®ãããã©ãŠã¶æ¡åŒµæ©èœã«é¢é£ããã»ãã¥ãªãã£ãªã¹ã¯ãè©äŸ¡ããããã®åºæ¬çãªææ³ã§ããæ¡åŒµæ©èœãèŠæ±ããæš©éãçè§£ãããã®JavaScriptã³ãŒããåæãããã¹ããã©ã¯ãã£ã¹ã«åŸãããšã§ãéçºè ãã»ãã¥ãªãã£ç ç©¶è ãããã³ãŠãŒã¶ãŒã¯ãã©ãŠã¶ã®ã»ãã¥ãªãã£ãå€§å¹ ã«åäžãããæªæã®ããæ¡åŒµæ©èœãã身ãå®ãããšãã§ããŸããè匱æ§ã®ç©æ¥µçãªç·©åã¯ãç¶ç¶çãªèŠæãšãŠãŒã¶ãŒæè²ãšçµã¿åãããããšã§ãã°ããŒãã«ã³ãã¥ããã£ã«ãšã£ãŠå®å šã§ä¿¡é Œã§ãããã©ãŠãžã³ã°äœéšãç¶æããããã«äžå¯æ¬ ã§ããæ°ããªè åšãžã®ç¶ç¶çãªåŠç¿ãšé©å¿ããç¶ç¶çãªã»ãã¥ãªãã£ã®éµãšãªããŸãã