[B! Security][CodeReview] raimon49ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

raimon49 id:raimon49

Securityã¨CodeReviewã«é–¢ã™ã‚‹raimon49ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (10)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒ¡ã‚¿ãƒƒãƒ—ã‚¹ãƒšã‚¤ãƒ¡ãƒ³ãƒˆä¸æ£ã‚¢ã‚¯ã‚»ã‚¹äº‹ä»¶ã®ç¬¬ä¸‰è€…å ±å‘Šæ›¸ã‹ã‚‰æ”»æ’ƒã®æ¨¡æ§˜ã‚’èªã¿è§£ã
æ ªå¼ä¼šç¤¾ãƒ¡ã‚¿ãƒƒãƒ—ã‚¹ãƒšã‚¤ãƒ¡ãƒ³ãƒˆã®é‹å–¶ã™ã‚‹æ±ºæ¸ˆä»£è¡Œã‚·ã‚¹ãƒ†ãƒ ã‹ã‚‰ç´„288ä¸‡ä»¶ã®ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ãŒæ¼æ´©ã—ãŸä¸æ£ã‚¢ã‚¯ã‚»ã‚¹äº‹ä»¶ã«ã¤ã„ã¦ã€ç¬¬ä¸‰è€…å§”å“¡ä¼šã®å ±å‘Šæ›¸ãŠã‚ˆã³çµŒæ¸ˆç”£æ¥çœã®è¡Œæ”¿å‡¦åˆ†ï¼ˆæ”¹å–„å‘½ä»¤ï¼‰ãŒã‚ã„ã¤ã„ã§å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ ç¬¬ä¸‰è€…å§”å“¡ä¼šèª¿æŸ»å ±å‘Šæ›¸ï¼ˆå…¬è¡¨ç‰ˆï¼‰ ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰ç•ªå·ç‰å–æ‰±æ¥è€…ã«å¯¾ã™ã‚‹è¡Œæ”¿å‡¦åˆ†ã‚’è¡Œã„ã¾ã—ãŸ ï¼ˆMETI/çµŒæ¸ˆç”£æ¥çœï¼‰ æœ¬ç¨¿ã§ã¯ã€ä¸»ã«ç¬¬ä¸‰è€…å§”å“¡ä¼šã®èª¿æŸ»å ±å‘Šæ›¸ï¼ˆä»¥ä¸‹ã€Œå ±å‘Šæ›¸ã€ã¨è¡¨è¨˜ï¼‰ã‚’ãƒ™ãƒ¼ã‚¹ã¨ã—ã¦ã€ã“ã®äº‹ä»¶ã®æ”»æ’ƒã®æ§˜åã‚’èª¬æ˜Žã—ã¾ã™ã€‚ ã‚·ã‚¹ãƒ†ãƒ ã®æ¦‚è¦å ±å‘Šæ›¸ã«ã¯ã‚·ã‚¹ãƒ†ãƒ æ§‹æˆå›³ã‚„ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯æ§‹æˆå›³ã¯è¨˜è¼‰ã•ã‚Œã¦ã„ãªã„ãŸã‚ã€å ±å‘Šæ›¸ã®å†…å®¹ã‹ã‚‰æŽ¨æ¸¬ã«ã‚ˆã‚Šã‚·ã‚¹ãƒ†ãƒ ã®æ§‹æˆã‚’ä»¥ä¸‹ã®ã‚ˆã†ã«ä»®å®šã—ã¾ã—ãŸã€‚ å›³ä¸ã®ã‚µãƒ¼ãƒãƒ¼åã¯å ±å‘Šæ›¸ã®è¨˜è¼‰ã«å¾“ã£ã¦ã„ã¾ã™ã€‚ä»¥ä¸‹ã€æ¦‚è¦ã‚’èª¬æ˜Žã—ã¾ã™ã€‚ ã‚µãƒ¼ãƒåæ¦‚è¦ Aç¤¾ã‚¢ãƒ—ãƒªä¸€èˆ¬ç¤¾å›£æ³•äººA ä¼šå“¡å‘ã‘ç”³è¾¼ã¿ãƒ•ã‚©ãƒ¼ãƒ çµŒç”£çœæ”¹å–„å‘½ä»¤ã§ã¯ã€ã€ŒåŒç¤¾ã¨ã‚³ãƒ³ãƒ“ãƒ‹æ±ºæ¸ˆã«ä¿‚ã‚‹å¥‘ç´„ã‚’ç· çµã—ã¦ã„
raimon49 2022/07/04
CodeReview

DB

Security

XSS

encryption

guideline

login

password

payment

ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰
ãƒªãƒ³ã‚¯
æœ¬å½“ã«ã‚ã£ãŸæ€–ã„è„†å¼±æ€§ã®è©±
PHPerkaigi 2022 Day2 Track B
raimon49 2022/04/12
CodeReview

PHP

Security

WordPress

license

login

password

privacy

ãƒ›ãƒ©ãƒ¼

å¤§å…¬é–‹æ™‚ä»£
ãƒªãƒ³ã‚¯
Homebrewã®Caskãƒªãƒã‚¸ãƒˆãƒªã‚’ä»‹ã—ãŸä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œ
English version is available here: https://blog.ryotak.net/post/homebrew-security-incident-en/ (å…¬å¼ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆå ±å‘Šã¯ã“ã¡ã‚‰ã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™: https://brew.sh/2021/04/21/security-incident-disclosure/) ã¯ã˜ã‚ã«Homebrewãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯HackerOneä¸Šã§è„†å¼±æ€§é–‹ç¤ºåˆ¶åº¦(Vulnerability Disclosure Program)ã‚’è¨ã‘ã¦ãŠã‚Šã€è„†å¼±æ€§ã®è¨ºæ–è¡Œç‚ºãŒè¨±å¯ã•ã‚Œã¦ã„ã¾ã™ã€‚ æœ¬è¨˜äº‹ã¯ã€å½“è©²åˆ¶åº¦ã«å‚åŠ ã—ã€Homebrewãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã®ã‚¹ã‚¿ãƒƒãƒ•ã‹ã‚‰è¨±å¯ã‚’å¾—ãŸä¸Šã§å®Ÿæ–½ã—ãŸè„†å¼±æ€§è¨ºæ–è¡Œç‚ºã«ã¤ã„ã¦è§£èª¬ã—ãŸã‚‚ã®ã§ã‚ã‚Šã€ç„¡è¨±å¯ã®è„†å¼±æ€§è¨ºæ–è¡Œç‚ºã‚’æŽ¨å¥¨ã™ã‚‹ã“ã¨ã‚’æ„å›³ã—ãŸã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ Homebrewã«è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸå ´åˆã¯ã€
raimon49 2021/05/03
CI

CodeReading

CodeReview

Mac

Ruby

Security

YAML

æ£è¦è¡¨ç¾
ãƒªãƒ³ã‚¯
ãƒŸãƒã‚½ã‚¿å¤§ã‹ã‚‰Linuxã«é€ã‚‰ã‚ŒãŸè„†å¼±æ€§ã‚’å«ã‚€è²¢çŒ®ã®ä»¶
Greg K-H @gregkh Linux kernel developers do not like being experimented on, we have enough real work to do: lore.kernel.org/linux-nfs/YH%2â€¦ 2021-04-21 17:27:05 Yoshimasa Niwa @niw ãƒŸãƒã‚½ã‚¿å¤§å¦ãŒLinuxã‹ã‚‰è¿½æ”¾ã•ã‚ŒãŸæ¨¡æ§˜... â€œI will now have to ban all future contributions from your University and rip out your previous contributionsâ€ lore.kernel.org/linux-nfs/YH%2â€¦ 2021-04-22 01:24:20
raimon49 2021/04/23
CodeReview

Linux

OSS

Security

america

patch

science
ãƒªãƒ³ã‚¯
GitHub - SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095: Struts2ã®è„†å¼±æ€§S2-045, S2-055 ãŠã‚ˆã³ Jackson ã®è„†å¼±æ€§ CVE-2017-7525, CVE-2017-15095 ã®èª¿æŸ»å ±å‘Š
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
raimon49 2017/12/09
CodeReview

Java

JSON

OSS

Security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
ES6æ™‚ä»£ã«ãŠã‘ã‚‹Webé–‹ç™ºè€…ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¥ç•Œã®ä¹–é›¢
Using JavaScript ES2015 (ES6), ES2016, ES2017 in production
raimon49 2015/03/09
èªã‚ãªã„ã‹ã‚‰è©•ä¾¡ã—ã‚ˆã†ãŒãªã„å•é¡Œã€‚

ClosureTools

CodeReview

JavaScript

Reactive

Security

programming
ãƒªãƒ³ã‚¯
OpenSSLã«ã¯ã“ã‚“ãªã«å•é¡ŒãŒ! LibreSSLé–‹ç™ºè€…ãŒç™ºè¡¨ - BSDCan2014
The OpenBSD project produces a FREE, multi-platform 4.4BSD-based UNIX-like operating system. OpenBSDãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã®é–‹ç™ºè€…ã§ã‚ã‚ŠLibreSSLã®é–‹ç™ºã«æºã‚ã£ã¦ã„ã‚‹Bob Beckæ°ã¯5æœˆ17æ—¥(ã‚«ãƒŠãƒ€æ™‚é–“)ã€ã€ŒBSDCan2014: LibreSSLã€ã«ãŠã„ã¦LibreSSLã®é–‹ç™ºãŒã¯ã˜ã¾ã£ã¦ã‹ã‚‰ã®ãŠãŠã‚ˆã30æ—¥é–“ã®ã§ãã”ã¨ã‚’ä¼ãˆãŸã€‚ãªãœOpenSSLã‹ã‚‰LibreSSLã‚’æ´¾ç”Ÿã•ã›åˆ¥ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¨ã—ã¦å–ã‚Šçµ„ã‚€ã“ã¨ã«ã—ãŸã®ã‹ã€å…·ä½“çš„ã«ã©ã†ã„ã£ãŸå¤‰æ›´ã‚’å®Ÿæ–½ã—ãŸã®ã‹ãªã©ãŒèª¬æ˜Žã•ã‚ŒãŸã€‚ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‚’ç«‹ã¡ä¸Šã’ã‚‹ãã£ã‹ã‘ã¯Heartbleedè„†å¼±æ€§ãŒæ±ºã‚æ‰‹ã ã£ãŸã®ã§ã¯ãªãã€ãã®ã‚ã¨ã«å–ã‚Šçµ„ã‚“ã ä½œæ¥ã«ã‚ˆã£ã¦åˆ¥ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã«ã™ã‚‹ã¨ã„ã†åˆ¤æ–ãŒæ±ºå®šçš„ãªã‚‚ã®ã«ãªã£ãŸã¨èª¬æ˜ŽãŒã‚ã£ãŸã€‚æ‡¸å¿µã•ã‚ŒãŸç‚¹ã¯ç‰¹ã«æ¬¡ã®ã¨ãŠã‚Šã€‚
raimon49 2014/05/18
ç‹¬è‡ªmalloc

CodeReview

OSS

Security

SSL
ãƒªãƒ³ã‚¯
ã€Œã‚ãŸã—ã¯ä¸å¹¸ã«ã‚‚è¦‹é€ƒã—ãŸã€ï¼šå£Šæ»…çš„ãƒã‚°ãƒ»Heartbleedã‚’è¿½åŠ ã—ãŸäººç‰©ã¸ã®ã‚¤ãƒ³ã‚¿ãƒ´ãƒ¥ãƒ¼
raimon49 2014/04/15
CodeReview

OSS

Security

SSL

patch

ã‚¤ãƒ³ã‚¿ãƒ“ãƒ¥ãƒ¼
ãƒªãƒ³ã‚¯
ãƒ”ã‚¯ã‚·ãƒ–ã§ã®é–‹ç™º - é‡‘é«ªã®ç¥žã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã€kamipoã•ã‚“ã«é–‹ç™ºã®å…¨ã¦ã‚’æ•™ã‚ã£ãŸè©± | STORYS.JP äººç”Ÿç‰©èªž
çˆ†é€Ÿã§æˆé•·ã—ã¦ã„ãŸã€ãƒ™ãƒ³ãƒãƒ£ãƒ¼ä¼æ¥ãƒ”ã‚¯ã‚·ãƒ– é¢æŽ¥ã®æ™‚ã®è©±ã¯ã“ã¡ã‚‰=>ãƒ”ã‚¯ã‚·ãƒ–ã«å…¥ã‚‹ã¨ãã®è©± ãã‚“ãªè¨³ã§ã€ãƒ”ã‚¯ã‚·ãƒ–ã§ã‚¢ãƒ«ãƒã‚¤ãƒˆã¨ã—ã¦åƒãã“ã¨ã¨ãªã£ãŸç§ã¯ã€åˆå‡ºå‹¤ã®æ—¥ã‚’è¿ŽãˆãŸã€‚ ï¼ˆâ†‘ãƒ”ã‚¯ã‚·ãƒ–ã®ãƒ¦ãƒ‹ãƒ¼ã‚¯ãªã‚ªãƒ•ã‚£ã‚¹ï¼‰ ã»ã¼ä½•ã‚‚åˆ†ã‹ã‚‰ãšå§‹ã¾ã£ãŸé–‹ç™º ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚¹ã‚ãƒ«ã¯ã»ã¼ç„¡ãã€ã‚„ã‚‹ã“ã¨ã‚‚æ±ºã¾ã£ã¦ã„ãªã‹ã£ãŸç§ã¯ã€æ—©é€Ÿé–‹ç™ºã®çµ±æ‹¬ã‚’ã—ã¦ã„ãŸCTOã®é’æœ¨ã•ã‚“ã‹ã‚‰ã®æŒ‡ç¤ºã‚’ä»°ã„ã ã€‚ ç§ã€Œé’æœ¨ã•ã‚“ã€ä½•ã‚’ã™ã‚Œã°è‰¯ã„ã§ã™ã‹ï¼Ÿã€ é’æœ¨ã•ã‚“ã€Œãã†ã ãã€œã¨ã‚Šã‚ãˆãšã“ã‚Œã®ãƒ¢ãƒã‚¤ãƒ«ç‰ˆã‚’ä½œã£ã¦æ¬²ã—ã„ãªã€œã€ ç§ã€Œåˆ†ã‹ã‚Šã¾ã—ãŸï¼ï¼ˆåˆ†ã‹ã£ã¦ãªã„ï¼‰ã€ é’æœ¨ã•ã‚“ã€ŒSubversionã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆç™ºè¡Œã—ã¨ãã‹ã‚‰ã€ã¾ãšã¯ç’°å¢ƒä½œã£ã¦ã¿ã¦ã€œã€ ç§ã€Œã¯ã„ï¼ï¼ˆåˆ†ã‹ã£ã¦ãªã„ï¼‰ã€ é’æœ¨ã•ã‚“ã€Œã‹ã¿ã½ã€œæºéƒ¨å›ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆä½œã£ã¦ã‚ã’ã¦ã€œã€ kamipoã•ã‚“ã€Œã¯ã„ã€ ã“ã‚“ãªæ„Ÿã˜ã§ã€è©±ã¯é€²ã‚“ã§ã„ã£ãŸã€‚ ãã—ã¦ã€ç§ã¯æ—©é€Ÿå›°ã£ãŸã€‚ ã€ŒSubversionã£ã¦ä½•ã ã‚
raimon49 2014/02/19
ä¸€ã¤ä¸€ã¤ã®ã‚¨ãƒ”ã‚½ãƒ¼ãƒ‰ãŒå…·ä½“çš„ã§è‰¯ã„ã€‚æƒ…æ™¯ãŒæµ®ã‹ã¶ã€‚

CodeReview

PHP

Security

Subversion

SQL

Terminal

bash

pixiv

æ•™è‚²
ãƒªãƒ³ã‚¯
è‡ªå·±æµã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã¯å±é™º
HTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å¯¾è±¡ã¨ãªã‚‹ < > & " ã®4æ–‡å—ã¯ã€æ–‡å—å®Ÿä½“å‚ç…§ã«å¤‰æ›ã•ã‚ŒãŸå¾Œã€preg_replaceé–¢æ•°ã§ã‚»ãƒŸã‚³ãƒãƒ³ã‚’å‰Šé™¤ã—ã¦ã—ã¾ã†ã®ã§ã€ä¸é€”åŠç«¯ãªå¦™ãªæ–‡å—åŒ–ã‘ã«ãªã‚Šãã†ã§ã™ã€‚ ä¸€èˆ¬çš„ãªåŽŸå‰‡ã¨ã—ã¦ã¯ã€ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã«ã¯HTMLã®å½¢ã§ã¯ãªããƒ—ãƒ¬ãƒ¼ãƒ³ãƒ†ã‚ã‚¹ãƒˆã®å½¢ã§ä¿å˜ã—ã¦ãŠãã€HTMLã¨ã—ã¦è¡¨ç¤ºã™ã‚‹ç›´å‰ã«HTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹æ–¹æ³•ã§çµ±ä¸€ã™ã‚‹ã“ã¨ã§ã€ä¸Šè¨˜ã®ã‚ˆã†ãªæ–‡å—åŒ–ã‘ã‚„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ¼ã‚Œã‚’ãªãã™ã“ã¨ãŒã‚ˆã„ã§ã—ã‚‡ã†ã€‚ è„†å¼±æ€§ã¯ãªã„ã®ã‹ ã“ã®sanitizeé–¢æ•°ã«è„†å¼±æ€§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚ä¸Šè¡¨ã®ã‚ˆã†ã«ã€ãƒãƒƒã‚¯ã‚¹ãƒ©ãƒƒã‚·ãƒ¥ï¼ˆå††è¨˜å·ï¼‰ã‚’ç´ é€šã—ã—ã¦ã„ã‚‹ã®ã§ã€MySQLã‚„ã€è¨å®šã«ã‚ˆã£ã¦ã¯PostgreSQLã®å ´åˆã«ã€å•é¡ŒãŒç”Ÿã˜ãã†ã§ã™ã€‚ä»¥ä¸‹ã€ãã‚Œã‚’èª¬æ˜Žã—ã¾ã™ã€‚ä»¥ä¸‹ã®èª¬æ˜Žã§ã¯ã€MySQLã‚’ä½¿ã†æƒ³å®šã¨ã—ã¾ã™ã€‚ ä»¥ä¸‹ã®ã‚ˆã†ã«ã€ãƒã‚°ã‚¤ãƒ³å‡¦ç†ã‚’æƒ³å®šã—ãŸSQLæ–‡çµ„ç«‹ãŒã‚ã£ãŸã¨ã—ã¾ã™ã€‚ $sql = sprintf(
raimon49 2013/02/23
CodeReview

PHP

Security

SQL
ãƒªãƒ³ã‚¯
1