ActionClass JSP ActionClass ActionClass Action PG

Size: px

Start display at page:

Download "ActionClass JSP ActionClass ActionClass Action PG"

みさえみしま
7 years ago
Views:

1 WEB

2 ActionClass JSP ActionClass ActionClass Action PG URL <SCRIPT> </SCRIPT>  POST Web hidden SQL

1.5. <SCRIPT> </SCRIPT>...14 7.1.6. <!-- -->...14 7.1.7....14 7.1.8....15 7.2....16 7.3....17 7.4. POST.

3 Java JavaScript URL ZeroConfiguration JFreeChart JavaProgrammingStyleGuidelines Java Action Class HttpRequestHttpResponse ActionClass XSS SQL...27

JFreeChart http://struts.apache.org/2.x/docs/jfreechart-plugin.html...22 11.1.5. JavaProgrammingStyleGuidelines...22 11.1.6. Java...22 11.2....22 11.2.1. Action Class HttpRequestHttpResponse.

4 1. Struts2 Framework Web Zero Configuration 2. Web CSVSG Struts2 struts2 2.1 Struts2 Struts 2

5 Struts ActionClass ActionClass Action

6 5. Struts2 Framework 5.1. JSP HelloWorld.jsp 5.2. ActionClass HelloWorld.java

7 5.3. ActionClass struts.xml 5.4. Action PG ActionClass Test JUnit HelloWorldTest.java

8 6. Struts ActionSupport validate public void validate() { LinkedList errormessages = new LinkedList(); if ( username == null username.length() == 0 ) { errormessages.add("username field is required."); } if ( password == null password.length() == 0 ) { errormessages.add("password field is required."); } if (!errormessages.isempty() ) { setactionerrors(errormessages); } } 6.2. validation.xml Sample2Input.jsp <s:form action= Sample2 > <s:textfield label= name= item /> <s:submit /> </s:form> Sample2-validation.xml <validators> <validator type= requiredstring > <param name= fieldname >item </param>

"); } if (!errormessages.isempty() ) { setactionerrors(errormessages); } } 6.2. validation.xml Sample2Input.

9 <message> XXX </message> </validator> </ validators 7. Web Buffer Overflow Cross Site Scripting Parameter Manipulation Backdoor & Debug Options Forceful Browsing Session HijackingReplay Path Traversal SQL InjectionSQL OS Command InjectionOS (10)Client Side Comment (11)Error Codes 7.1.

Backdoor & Debug Options Forceful Browsing Session HijackingReplay Path

10 HTML 3 & & < < > > <SCRIPT> HTML 5 & & < < > > " " ' ' 5 <IMG src="$selected_icon"> <IMG src=$selected_icon> $selected_icon="no_such_icon onerror=alert(document.cookie);" <IMG src=no_such_icon onerror=alert(document.cookie);>

11 URL A href IMG src URL URL URL URL URL javascript:alert("hello"); vbscript:msgbox("hello"); about:<script>alert("hello");</script> NetscapeNavigator 1 A 3 Mozilla0.9.5 Windows NetscapeNavigator 1 <A href="&{alert('hello');};">need not to click me</a> 2 3 <A href="javascript:alert('clicked'); &{alert('page loaded');};">here</a> 4 5 NetscapeNavigator 4.72 Windows URL URL URL URL HTML URL 3 ez_url_sanitize() RFC URL 14 httphttpsmailto2028

about:<script>alert("hello");</script> NetscapeNavigator 1 A 3 Mozilla0.9.

12 URL URL URL HTML RFC2396 URIUniformed Resource Identifiers URLUniformed Resource Locators URI URI URL RFC RFC2396 URL URL -_.!~*'()% 18 RFC2396 URL +-.RFC2396 Perl &' HTML 14 URL $url <>"<>" HTML 3 URL 1 $url = &ez_url_sanitize($url); # $url 2 3 sub ez_url_sanitize { 4 my $url = $_[0]; 5 6 ### URL ### 7 # # uric = reserved unreserved escaped 9 # reserved = ";" "/" "?" ":" "@" "&" "=" "+" "$" "," 10 # unreserved = alphanum mark 11 # mark = "-" "_" "." "!" "~" "*" "'" "(" ")" 12 # escaped = "%" hex hex

$RFC2396 Perl 18 20 2426 3132 &' HTML 14 URL $url <>"<>" HTML 3 URL 1 $url = &ez_url_sanitize($url); # $url 2 3 sub ez_url_sanitize { 4 my $url = $_[0];$

13 13 14 return '' if($url =~ m [^;/?:@&=+ $,A-Za-z0-9 -_.!~*'()%] ); ### ### 17 # # scheme = alpha *( alpha digit "+" "-" "." ) if($url =~ /^([A-Za-z][A-Za-z ]*):/) { 21 # $url 22 my $scheme = lc($1); # 23 my $allowed = 0; 24 $allowed = 1 if($scheme eq 'http'); 25 $allowed = 1 if($scheme eq 'https'); 26 $allowed = 1 if($scheme eq 'mailto'); 27 return '' if(not $allowed); 28 } ### HTML ### 31 # special = "&" "<" ">" '"' "'" 32 # URL "<"">"'"'$url $url =~ s/&/&/g; # & & 35 $url =~ s/'/'/g; # ' ' return $url; 38 } on onchange onmouseover onload onerror

]*):/) { 21 # $url 22 my $scheme = lc($1); # 23 my $allowed = 0; 24 $allowed = 1 if($scheme eq 'http'); 25 $allowed = 1 if($scheme eq 'https'); 26 $allowed = 1

14 HTML 1 <SPAN onmouseover="alert('');"></span> OPTION value <SCRIPT> </SCRIPT> <SCRIPT> external.js 1 <SCRIPT src="external.js"></script>   1 1 <script> 2  5 </script> CSS HTML IPA 1 <BR style=left:expression(eval(

js"></script> 7.1.6. <!-- --> <!-- --> 1 1 <script> 2 <!

15 'document.location=" 1 <STYLE type="text/javascript"> 2 document.location=" 3 </STYLE> JavaScript HTML <HEAD></HEAD> metalic_design.css metalic_design.css 1 <LINK rel="stylesheet" href="metalic_design.css"> URL 1 <LINK rel="stylesheet" href="javascript:alert('hello');"> 1 <STYLE type="text/css"> url(javascript:alert('hello')); 3 </STYLE> malicious.css <LINK rel="stylesheet" href=" 1 body { left: expression(eval( 2 'document.location=" }

css"> URL 1 <LINK rel="stylesheet" href="javascript:alert('hello');"> 1 <STYLE type="text/css"> 2 @import url(javascript:alert('hello')); 3 </STYLE> http://victim/index.

16 7.2. JavaScript WWW WWW HTML JavaScript 4 5

17 7.3. ID Web 7.4. POST Web POST ox=1&mailid=385 URL?"user= ""pw=0409" ID

18 7.5. Web ID Web 7.6. hidden hidden Web HTML hidden WWW WWW hidden HTML 5 hidden MEMBERFLG 0 HTML HTML HTML

19 7.7. SQL SQL $yosan SELECT HINMEI, KAKAKU FROM SHOUHIN_TABLE WHERE KAKAKU<=$yosan SQL $yosan SQL 8. Log4j 9. properties struts.xml MessageResources.properties <struts> <constant name = struts.custom.i18n.resources value= MessageResources /> Java 9.5 Java

properties <struts> <constant name = struts.custom.i18n.

20 Java HTMLXMLJSP Java Java Class Method Field JavaDoc

21 JavaScript Java JSPHTMLXML

22 URL ZeroConfiguration JFreeCharthttp://struts.apache.org/2.x/docs/jfreechart-plugin.html JavaProgrammingStyleGuidelines Java Action Class HttpRequestHttpResponse // // struts.xml // <action name="accessrequest" class="net.roseindia.accessrequest"> <result>/pages/staticparameter/accessrequest.jsp</result> </action> // // AccessRequest.java // ServletRequestAware,ServletResponseAware implements // setservletrequestsetservletresponsegetservletrequest // getservletresponse package net.roseindia; import javax.servlet.http.httpservletrequest; import javax.servlet.http.httpservletresponse; import com.opensymphony.xwork2.actionsupport; import org.apache.struts2.interceptor.servletrequestaware; import org.apache.struts2.interceptor.servletresponseaware; public class AccessRequest extends ActionSupport implements ServletRequestAware,ServletResponseAware{ private HttpServletRequest request; private HttpServletResponse response; public String execute() throws Exception{

23 return SUCCESS; } public void setservletrequest(httpservletrequest request){ this.request = request; } public HttpServletRequest getservletrequest(){ return request; } public void setservletresponse(httpservletresponse response){ this.response = response; } } public HttpServletResponse getservletresponse(){ return response; } // //AccessRequest.jsp // <%@ taglib prefix="s" uri="/struts-tags" %> <%@page language="java" import="java.util.*" %> <html> <head><title>access Request and Response Example! </title> </head> <body> <h1><span style="background-color: #FFFFcc">Access Request and Response Example!</span></h1> <b>request: </b><%=request%><br> <b>response: </b><%=response%><br> <b>date: </b><%=new Date()%> </body> </html> ActionClass // // SomeAction.java // import java.util.map; import org.apache.struts2.interceptor.sessionaware; public class SomeAction extends ActionSupport implements SessionAware{ // private Map session; public String execute() throws Exception { session.put("message", ""); return SUCCESS; } // public void setsession(map session) {

24 // this.session = session; } } // // SomeAction.jsp // <%@ page contenttype="text/html; charset=utf-8" %> <%@ page pageencoding="windows-31j" %> <%@ taglib uri="/struts-tags" prefix="s" %> <html> <head><title></title></head> <body> <h2>: <s:property value="#session.message "/></h2> </body> </html> XSS XSS HTML cgi

25 7.2.2 HTML HTML XSS HTML <s>kokubu</s> XSS Web kokubu ( 7.2.3)

26 7.2.3 kokubu HTML <s>kokubu</s> <s>kokubu</s> script <script>alert("xss");</script> XSS

27 7.2.4 script <script>alert("xss");</script> SQL SQL SQL SQL SQL UPDATE USER_TBL SET PASSWORD=$newpwd WHERE USER=$user AND PASSWORD=$curpwd ID $user $curpwd $newpwd SQL $curpwd "paul' or USER='admin" SQL USER smith PASSWORD paul USER admin UPDATE SQL UPDATE USER_TBL SET PASSWORD=$newpwd WHERE USER=$user AND PASSWORD='paul' or USER='admin'

28 ."WHERE KAKAKU<=$yosan";

Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 3 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved.

2006 12 14 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 2 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 3 Copyright 2006 Mitsui Bussan Secure Directions,