文字コードに潜むセキュリティ

Size: px

Start display at page:

Download "文字コードに潜むセキュリティ"

れんかつまがみ
7 years ago
Views:

1 Yosuke HASEGAWA /

2 2

3 3

4 4

5 5

6 6

7 7

8 8

9 9

10 10

11 11

12 12

13 13

14 14

15 Valid Invalid / 0x2F 0xC0 0xAF U+002F 0xE0 0x80 0xAF 0xF0 0x80 0x80 0xAF 15

16 /etc/passwd passwd /appdir/passwd 16

17 ..(0xC0 0xAF)etc(0xC0 0xAF)passwd..(0xC0 0xAF)etc(0xC0 0xAF)passwd /appdir/../etc/passwd 17

18 18

19 19

20 20

21 U+005C U+00A5 U+20A9 0x5C 21

22 .... U+00A x5C 22

23 23

24 24

25 ! U+00A1 0xA5 U+00A6 0x7C À Á Â Ã Ä Å Æ A U+00C4 U+00C5 U+00C6 U+00C0 U+00C1 U+00C2 U+00C3 A 0x41 25

26 26

27 27

28 28

29 29

30 Gif / GIF Maße/MASSE Maße / Masse 30

31 31

32 stricmp wcsicmp _ stricmp _ wcsicmp _mbsicmp _stricmp_l _wcsicmp_l _mbsicmp_l CompareString CompareStringEx CompareStringOrdinal lstrcmpi IntlStrEqNI StrCmpI StrCmpIC StrCmpNIC StrIsIntlEqual... 32

33 33

34 34

35 U+304C U+304B U

36 36

37 . U+2025 U+002E. U+002E 1 U+2473 U

38 U U+005C 38

39 39

40 40

41 41

42 42

43 43

44 44

45 <html> 45

46 46

47 47

48 48

49 " & q u o t ; 82 A A F 74 3B " "

50 50

51 51

52 52

53 53

54 エンコード情報の不一致サーバ側とクライアント側で異なる charsetと解釈される典型的には UTF-7 によるXSS UTF-8 < < & t > > " " & & ' ' 処理 INNOVATION TO THE FUTURE エスケープ NetAgent Co., Ltd. UTF-7 <html> <; > HTML生成ユーザ 54

55 55

56 56

57 57

58 58

59 59

60 60

61 /

62 62

63 63

64 64

65 65

66 66

67 [ { "name" : "abc+mpv/fwaiah0axqa7 var t+ad0awwb7aciaig :+ACI ", "mail" : "hasegawa@utf 8.jp" }, { "name" : "John Smith", "mail" : "john@example.com" } ] p// p / j 67

68 [ { "name" : "abc"}];var t=[{"":"", "mail" : "hasegawa@utf 8.jp" }, { "name" : "John Smith", "mail" : "john@example.com" } ] p// p / j 68

69 [ { "name" : "abc"}];var t=[{"":"", "mail" : "hasegawa@utf 8.jp" }, { "name" : "John Smith", "mail" : "john@example.com" } ] p// p / j <script src=" charset="utf 7"> <script> alert( t[ 1 ].name + t[ 1 ].mail l) ); </script> 69

70 Content Type: application/json; charset=utf 8 [ { "name"": "abc"}];var b"}] t[{"""" t=[{"":"", "mail" : "hasegawa@utf 8.jp" }, { "name" : "John Smith", "mail" : "john@example.com" } ] charset IE6,7 <script src=" charset="utf 7"> <script> alert( t[ 1 ].name + t[ 1 ].mail ); </script> 70

71 71

72 72

73 73

74 0x x3C x3E xA2 0xBC 0xBE

75 75

76 0x4D xCD x36 0xB

77 77

78 78

79 79

80 80

81 81

82 82

83 / Solidus / Division Slash 83

84 g g ɡ Lattin Small Letter G Lattin Small Letter Script G ɡ 84

85 ɡ 85

86 ɡ 86

87 ɡ 87

88 ɡ 88

89 ɡ 89

90 ɡ 90

91 91

92 U+200B U+200C U+200D U+202A U+FEFF ZERO WIDTH SPACE ZERO WIDTH NON-JOINER ZERO WIDTH JOINER LEFT-TO-RIGHT TO EMBEDDING BYTE ORDER MARK (ZWNBSP) 92

93 93

94 94

95 95

96 96

97 97

98 98

99 99

100 100

101 101

102 102

●70974_100_AC009160_KAPヘ<3099>ーシス自動車約款（11.10）.indb

●70974_100_AC009160_KAPヘ<3099>ーシス自動車約款（11.10）.indb " # $ % & ' ( ) * +, -. / 0 1 2 3 4 5 6 7 8 9 : ; < = >? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y " # $ % & ' ( ) * + , -. / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B