Yosuke HASEGAWA http://j.mp/yosuke /
2
3
4
5
6
7
8
9
10
11
12
13
14
Valid Invalid / 0x2F 0xC0 0xAF U+002F 0xE0 0x80 0xAF 0xF0 0x80 0x80 0xAF 15
/etc/passwd passwd /appdir/passwd 16
..(0xC0 0xAF)etc(0xC0 0xAF)passwd..(0xC0 0xAF)etc(0xC0 0xAF)passwd /appdir/../etc/passwd 17
18
19
20
U+005C U+00A5 U+20A9 0x5C 21
.... U+00A5.... 0x5C 22
23
24
! U+00A1 0xA5 U+00A6 0x7C À Á Â Ã Ä Å Æ A U+00C4 U+00C5 U+00C6 U+00C0 U+00C1 U+00C2 U+00C3 A 0x41 25
26
27
28
29
Gif / GIF Maße/MASSE Maße / Masse 30
31
stricmp wcsicmp _ stricmp _ wcsicmp _mbsicmp _stricmp_l _wcsicmp_l _mbsicmp_l CompareString CompareStringEx CompareStringOrdinal lstrcmpi IntlStrEqNI StrCmpI StrCmpIC StrCmpNIC StrIsIntlEqual... 32
33
34
U+304C U+304B U+3099 35
36
. U+2025 U+002E. U+002E 1 U+2473 U+0031 37
U+2025.... U+005C 38
39
40
41
42
43
44
<html> 45
46
47
48
" & q u o t ; 82 A0 22 82 A0 26 71 75 6F 74 3B " " 82 22 82 22 49
50
51
52
53
エンコード情報の不一致 サーバ側とクライアント側で異なる charsetと解釈される 典型的には UTF-7 によるXSS UTF-8 < < & t > > " " & & ' ' 処理 INNOVATION TO THE FUTURE エスケープ NetAgent Co., Ltd. UTF-7 <html> <; > HTML生成 ユーザ 54
55
56
57
58
59
60
http://www.google.com/search?oe=cp932&q=%2badw... / http://www.google.com/search?oe=cp950&q=%2badw... http://search.yahoo.com/search?eo=euc&p=%2badw... 61
62
63
64
65
66
[ { "name" : "abc+mpv/fwaiah0axqa7 var t+ad0awwb7aciaig :+ACI ", "mail" : "hasegawa@utf 8.jp" }, { "name" : "John Smith", "mail" : "john@example.com" } ] http://example.com/newmail.json p// p / j 67
[ { "name" : "abc"}];var t=[{"":"", "mail" : "hasegawa@utf 8.jp" }, { "name" : "John Smith", "mail" : "john@example.com" } ] http://example.com/newmail.json p// p / j 68
[ { "name" : "abc"}];var t=[{"":"", "mail" : "hasegawa@utf 8.jp" }, { "name" : "John Smith", "mail" : "john@example.com" } ] http://example.com/newmail.json p// p / j <script src="http://example.com/newmail.json" charset="utf 7"> <script> alert( t[ 1 ].name + t[ 1 ].mail l) ); </script> 69
Content Type: application/json; charset=utf 8 [ { "name"": "abc"}];var b"}] t[{"""" t=[{"":"", "mail" : "hasegawa@utf 8.jp" }, { "name" : "John Smith", "mail" : "john@example.com" } ] charset IE6,7 <script src="http://example.com/newmail.json" charset="utf 7"> <script> alert( t[ 1 ].name + t[ 1 ].mail ); </script> 70
71
72
73
0x22 0010 0010 0x3C 0011 1100 0x3E 0011 1110 0xA2 0xBC 0xBE 1010 0010 1011 1100 1011 1110 74
75
0x4D 0100 1101 0xCD 1100 1101 0x36 0xB6 0011 0110 1011 0110 76
77
78
79
80
81
82
/ Solidus / Division Slash 83
g g ɡ Lattin Small Letter G Lattin Small Letter Script G ɡ 84
ɡ 85
ɡ 86
ɡ 87
ɡ 88
ɡ 89
ɡ 90
91
U+200B U+200C U+200D U+202A U+FEFF ZERO WIDTH SPACE ZERO WIDTH NON-JOINER ZERO WIDTH JOINER LEFT-TO-RIGHT TO EMBEDDING BYTE ORDER MARK (ZWNBSP) 92
93
94
95
96
97
98
99
100
101
102