サニタイズ言うなキャンペーン 
書きかけだけどとりあえず公開。
要約版：「サニタイズいうなキャンペーン」とは from 高木浩光＠自宅の日記
クエリ文字列を変換すれば「サニタイズ済み」つまり安全、と思ってる人、多いんですかね。便利な言葉はしばしば人を思考停止に陥れる。
脆弱性を突く文字列の汚染源としては、
- クエリ文字列
- DB問合せの結果や、ログファイルなどからの取得文字列
- HTTPヘッダ(RefererやCookieを含む)
- セッションに格納されたデータ
- URLの一部
などなど色んなものがある。汚染を利用した攻撃の対象となる処理系も
- SQL処理系(e.g. SQLインジェクション)
- Webクライアント(Webブラウザ)(e.g. XSS)
- shell
- 処理言語自身(evalなど)
と様々なケースが考えられる。3番目や4番目は普通やらないだろうと思うところだが、巷のスクリプトの脆弱性を見てると案外多い。こういうものに頼る傾向はあまり宜しくないと思う。
汚染源は前述の通りクエリ文字列だけではない。また、汚染源はエンコードが施されてあったり、プログラム側で処理されたりするので汚染源を直接変換したからといって安全にはならない。高木氏も触れているが、変換や削除が新たな汚染を生むこともある。また、攻撃対象の処理系によって「何が危険なのか」が異なってくる(危険なのはメタ文字だけではない)ので個別に対応する必要がある。「クエリ文字列をエスケープしただけ」で安全になるわけがないし、「サニタイズ」という一定かつ確実な方法があるわけでもない。
汚染源が何であろうと、安全でない文字列は攻撃対象となり得る処理系に渡される「直前」に「的確な」検証を行わないと確実な対策とはならない。
これも高木氏も触れられているが、汚染された文字列が、処理系に使われる直前に検証される様子が簡単に見渡せるコードを書くように努めることは脆弱性を埋め込む可能性を下げる。値が何に対して安全であるかを示す変数名を使うのも手だ。HTML出力用に変換した文字列をそのままSQL問合せに突っ込んでセキュリティ・ホールを作っている例を見たことがあるが、こういった事態は起こりにくくなるだろう。
$form = new myForm;
$sql_safe = $form->getSqlSafe();
$sql = "select name from user where uid = '{$sql_safe['uid']}'";
この場合、$sql_safeの安全性はmyFormクラスの設計に依存するのでコードを見渡しやすくなる。もちろん次のようなコードは論外だ。
funciton make_sql($sql_safe){
return "select name from user where uid = '{$sql_safe['uid']}'";
}
誰がどのようにmake_sql()を呼ぶか全く分からないので、$sql_safeが安全だという保証はどこにもない。眉間にマジックで「ハンサム」と書いてハンサムになった気でいるのと同じくらい間抜けだ。また、
- 処理系に渡される文字列(SQL問合せ文など)に、得体の知れない変数がボコボコ埋められている
- あるいは文字列置換関数などでぐちゃぐちゃにいじっている
- shell渡しやeval系の処理(perl-regexの’e'オプションを含む)に依存する
なんて状況は絶対に避けたいところだが、残念なことにこういったコードは結構多い。
2011/12/09 - 17:23:39 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/09 - 17:26:08 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/09 - 18:33:26 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/09 - 19:54:32 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/09 - 23:38:13 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/10 - 06:06:46 -
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/10 - 12:39:18 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/10 - 16:22:25 -
Related……
[… ]just beneath, are numerous totally possibly not related sites to our bait, however, they are absolutely worth going over[… ]……
2011/12/11 - 05:39:49 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/11 - 05:55:14 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/11 - 05:56:20 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/11 - 07:45:26 -
Great Source Of Web Marketing Material
[…]Writing about a subject like this can be rather challenging. It really is fantastic to understand some individuals nevertheless care about this[…]
2011/12/11 - 15:28:22 -
Great website…
[…]here are some hyper-links to sites that we link to as we feel they are really worth browsing[…]…
2011/12/12 - 01:12:09 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/12 - 07:15:33 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/12 - 18:04:27 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/12 - 20:18:25 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/12 - 20:19:06 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/12 - 22:42:10 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/12 - 23:26:36 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/13 - 04:37:54 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/13 - 04:40:09 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/13 - 08:55:12 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/13 - 12:52:03 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/13 - 19:09:29 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/13 - 19:44:01 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/13 - 20:29:56 -
Recommeneded websites…
[…]Here are some of the sites we recommend for our visitors[…]……
2011/12/13 - 21:04:05 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/13 - 23:38:23 -
Useful post.Keep it up
Fascinating article.
2011/12/14 - 00:01:27 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/14 - 02:09:33 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/14 - 03:24:56 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/14 - 04:01:40 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/14 - 05:03:50 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/14 - 06:06:08 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/14 - 10:52:53 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/14 - 17:32:28 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/14 - 18:47:00 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/14 - 19:33:10 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/14 - 20:49:52 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/14 - 22:36:53 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/14 - 22:48:16 -
Very interesting post
Very unique niche, with thanks for placing.
2011/12/15 - 00:55:25 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/15 - 05:34:13 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/15 - 07:59:01 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/15 - 10:23:07 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/15 - 15:56:43 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/15 - 19:07:49 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/15 - 19:14:33 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/15 - 19:54:44 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/15 - 20:35:33 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/15 - 21:56:50 -
dating websites
I have learn a few excellent stuff here. Definitely value bookmarking for revisiting. I surprise how so much attempt you put to create this sort of excellent informative web site.
2011/12/15 - 22:42:38 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/16 - 00:39:18 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/16 - 02:28:35 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/16 - 03:02:40 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/16 - 03:58:28 -
Where To Find Billiga Solglasögon Online
[…]Writing about a topic like this can be very difficult. You can find out far more about this topic[…]
2011/12/16 - 04:59:29 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/16 - 05:05:32 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/16 - 08:58:06 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/16 - 09:17:52 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/16 - 09:32:31 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…