Web�A�v��ɂ��11�̐Ǝ㐫�̏펯�Ƒ΍��FWeb�A�v��̏펯��JSP��Struts�Őg�ɂ��i11�j�i1/4 �y�[�W�j

�{�A�ڂ́AJSP�^�T�[�u��b�g�{Struts��Web�A�v��P�[�V��J��ʂ��āAJava��ȊO�iPHP��ASP.NET�ARuby on Rails�Ȃǁj�̊J��ɂ��ʗp��Web�A�v��P�[�V��S�ʂ̍L��m��E�펯��g�ɕt��邽�߂̘A�ڂł�

» 2009�N09��01�� 00��00�� J

[�R��G��C��Ѓ��Z�i�E�l�b�g�R��]

�y2013�N2��25��z�ҏW��A��тƒ��̂��m�点

�{�e�ɂ��ēǎ҂̊F��܂�葽��̂��w�E��܂��āA��ɂ��肪�Ƃ��܂��B�ҏW��ł��炽�߂Ē��ׂ��ʁA�ԈႢ��c��A��炽�߂ďC��ł��f�ڂ��Ă��܂��B��̓x�́A��ɂ킽��e��f�ڂ��̂ŁA�ǎ҂̊F��܂ɑ��Ȃ��f��|��_��ѐ\��グ�܂��B

�ʏ�A�L��ɊԈႢ��ꍇ�ɂ́A�M�Ҋm�F��ɏC��ł��f�ڂ��̂ł��A��̏ꍇ�A��o��莞�Ԃ��o�߂��Ă��܂��Ă��Ƃ��A�M�҂ƘA��܂��ł��B��͉e��傫��Ƃ��A�ҏW��Œ��镔��ɂ��Ă͋ɗ͑Ή��A�Čf�ڂ��Ă��܂��B�C��ɍۂ��ẮA�{�e�ɂ��w�E��ۍ_��܂ɂ��͂��܂��B��ۂ��܂ɂ́A��̏��؂�Ă��\��グ�܂��B�܂��A��e�ɂ��Đ��m��ɍ��_�A��炽�߂ēǎ҂̊F��܂ɂ��ѐ\��グ�܂��B

�؂��Ă��؂�Ȃ��H Web�A�v��P�[�V��ƐƎ㐫

�@��炽�߂Ċm�F��Ă��܂��AWeb�A�v��P�[�V��Ƃ́AWeb�T�[�o��œ��삷��\�t�g�E�F�A�̂��Ƃł��B��̗�ɂ́A�I��C��V��b�s��O�E�I��C��o��L��O�Ȃǂ��w��A��[�U�[��Web�u��E�U�ł��̃T�[�r�X�𗘗p��܂��B

�@��̂悤�ɁA��ɗ��֐��̍��Web�A�v��P�[�V��ł��ӂ��Ȃ��΂Ȃ�Ȃ��Ƃ��܂��B��́AWeb�A�v��P�[�V��ɂ���Z�L��e�B���Ǝ㐫�ɂ��Ă̖��ł��B

��Web�A�v��́A�J��҂ɂ��Ǝ㐫�ւ̑΍􂪕K�v

�@�Ǝ㐫�Ƃ́A�u�Ƃ��A��₷��A�U��ɑ΂��Ďア�v��Ƃł��B�n�[�h�E�F�A�̌��ׂ�\�t�g�E�F�A�̃o�O�A�z��O�̃I�y��[�V��Ȃǂ��A��ɓ��܂��B

�@��̃Z�L��e�B��ɂ��ẮAWeb�A�v��P�[�V��̐Ǝ㐫��U��̓��[�U�[��̒��ӂł͖h��Ƃ��ł��Ȃ��̂ŁA�\�t�g�E�F�A��񋟂��Ă��x��_��C��K�v��AWeb�A�v��P�[�V��ł͊J��҂��A�Z�L��e�B�ɂ��ď�ɗ��ӂ��A�΍��{��K�v��܂��B

��Web�A�v��ɑ΂��11�̑�\�I�ȍU��@

�@��ʓI��Web�T�[�o�̃Z�L��e�B�΍�Ƃ��ƁA�t�@�C�A�E�H�[��E�C��X�΍�Ȃǂ��܂��B��AWeb�A�v��P�[�V��ւ̍U��ɑ΂��ẮA��̑΍􂾂��ł͕s�\��ł��B

�@Web�A�v��P�[�V��ɂ��Z�L��e�B�z�[��̉��s��O�ɁA�ǂ̂悤�ȍU��@��݂��邩�ȒP�ɐ��܂��傤�B��݁A��ʓI�ɒm��Ă��\�I�ȍU��ɂ́A�ȉ��̂悤�Ȃ��̂��܂��B

**�\�@11�̑�\�I�ȍU��@�ꗗ**
	�U��@	�T�v
	XSS�i�N��X�T�C�g�X�N��v�e�B��O�j	��[�U�[��Web�u��E�U��ŕs��ȃX�N��v�g�𓮂��
	��I�u��E�W��O	URL�ȂǂŃ��N��Ă��Ȃ��閧��Ǘ��ҋ@�\�ɒ��ڃA�N�Z�X��
	SQL�C��W�F�N�V��	�s��͂ɂ��C�ӂ�SQL��s��
	�p��[�^�̉��	Web�A�v��P�[�V��̊��҂��l�Ƃ͕ʂ̒l�𑗐M��A�둀�삳��
	HTTP��X�\|��X��	�U�y�[�W�𑽐��̂ɐl�X�Ɍ��
	OS�R�}��h�C��W�F�N�V��	�s��͂ɂ��C�ӂ�OS�R�}��h��s��
	�Z�b�V��Ǘ��Ɋւ��Ǝ㐫	�Z�b�V��̐��ⓐ�p��s��
	�p�X�^�f�B��N�g��g��o�[�T��	��J��Ă��Ȃ��t�@�C��ɒ��ڃA�N�Z�X��
	�o�b�t�@�I�[�o�[�t��[	�z��͈̔͂𒴂��݂ɂ��A�O��w�肵��߂��s��
	�o�b�N�h�A�ƃf�o�b�O�I�v�V��	�J��҂��A�v��P�[�V��ɕs�p�ӂɎc��f�o�b�O�p�̋@�\�Ȃǂ��p��ĕs��ȑ��s��
	�G��[�R�[�h	�G��[��b�Z�[�W�̏��U��̎��ɂ��

�@��̍U��̂قƂ�ǂ��A�t�@�C�A�E�H�[��Ȃǂł͖h��Ƃ��ł��A�A�v��P�[�V��x��őΉ��Ȃ��Ă͂Ȃ�܂��B��́A�\�ɂ��11��ނ̐Ǝ㐫�ɂ��ĉ��A��̑΍��܂��B

�y1�zXSS�i�N��X�T�C�g�X�N��v�e�B��O�j

�@XSS�Ƃ́A��ӂ̂��X�N��v�g��K��҂�Web�u��E�U�ɍ��A��s��Ă��܂��Ǝ㐫�̂��Ƃł��B

�@�Ⴆ�΁A��͂��ʂɕ\��v��O��Ƃ��܂��B��̃v��O��ɓK�؂ȓ��͒l�`�F�b�N��Ă��Ȃ��ꍇ�A��ӂ̂���X�N��v�g��Web��ʂɖ��ߍ��܂�Ă��܂��A��[�U�[��Web�u��E�U��Ŏ��s��Ă��܂��܂��B��̌��ʁA�Z�b�V��̏��y�[�W�̏��A��J�ڂ��\�ƂȂ邽�߁A�t�B�b�V��O��\��g�Ȃ肷�܂��h�Ȃǂ̔ƍ߂ɗ��p��܂��B

��IT�F�N��X�T�C�g�X�N��v�e�B��O�΍�̊�{ via kwout

�@��ʓI�Ƀf�[�^�x�[�X��̓��L��A��[�U�[��̓��͓��e��̂܂ܕ\��ƁAXSS�̐Ǝ㐫�̌��ƂȂ�܂��B

��΍�

�@�΍�Ƃ��ẮA��ꕶ���G�X�P�[�v��̓f�[�^�`�F�b�N�Ȃǂ��K�v�ł��B

�ҏW��FXSS�̑΍�Ɋւ��ẮA�ȉ��̋L��Q�l�ɂ��Ă��΂Ǝv��܂�

�K�؂ȃG�X�P�[�v��XSS�ɔ��
Struts�ō��Z�L��AWeb�A�v��P�[�V��i1�j�@Java��Web�A�v��쐬��Ƃ��ɁA�Z�L��e�B�Œ��ӂ��ׂ��_�́H ��\�I�ȃJ�X�^��^�O�𕪐͂��
�@�@�@�@�@�@�uSecurity&Trust�v�t�H�[�� 2006/3/23

�T�[�u��b�g�R��e�i��F��
Struts�ō��Z�L��AWeb�A�v��P�[�V��i2�j�@�G��[�y�[�W�̏o�͂��ƂȂ��XSS��N��\��B�T�[�u��b�g�R��e�i�Ɉˑ��Ȃ��@�Ƃ́H
�@�@�@�@�@�@�uSecurity&Trust�v�t�H�[�� 2006/4/27

�N��X�T�C�g�X�N��v�e�B��O�΍�̊�{
�O�� N��X�T�C�g�X�N��v�e�B��O�Ǝ㐫�Ƃ́H
�� XSS�Ǝ㐫�ɂ��N��Q�Ƃ��̑΍�
�� XSS��h��߂ɕs��ȃT�j�^�C�W��O�i��Q��j
Web�A�v��P�[�V��ɑ��݂��Z�L��e�B�z�[��ƂȂ��Ă��A��̑�\�i�uXSS�v�̎d�g�݂��悤
�@�@�@�@�@�@�uSecurity&Trust�v�t�H�[��

mod_security��XSS�΍􃋁[��쐬��
Web�A�v��P�[�V��ɐ��ރZ�L��e�B�z�[��i12�j�@Web�A�v��P�[�V��t�@�C�A�E�H�[��́umod_security�v��^�p��B�܂��XSS�΍��{��Ă݂悤�c�c
�@�@�@�@�@�@�uSecurity&Trust�v�t�H�[�� 2004/9/16

XSS�͒m��ĂĂ��A��ꂾ��።��܂��H
��ǃC�`��I HTTP��b�P��i1�j�@Web�A�v��̃Z�L��e�B�ɂ��Ă��Əڂ��m�肽��ǁA�܂��׋��΂��́H ��ȋ^��ɉ��V�A�ځI
�@�@�@�@�@�@�uSecurity&Trust�v�t�H�[�� 2007/9/28

�}��`�o�C�g�̗��Ƃ��
��N��Web�A�v��ق̂ڂ̉��v��i10�j�@��ԍ₳��Ƃ��׋��B��Ƒ΍􂳂�Ă��悤�ɂ݂��̂ɁA��Ȕ��Ȃ�āI
�@�@�@�@�@�@�uSecurity&Trust�v�t�H�[�� 2006/9/23

$��Ԃ̔F��Ƃ̃M��b�v�\�\XSS�͖{��Ɋ�Ȃ��H$

��Ԃ̔F��Ƃ̃M��b�v�\�\XSS�͖{��Ɋ�Ȃ��H
��m�̃Z�L��e�B�E�v��C�x�[�g�E�A�C�Y�i13�j�@�Ǝ㐫��1�ł��c��Ă邾�Ȃ�Ę_�O�Ƃ��ł��傤�B�Ƃ��ł��̐Ǝ㐫�A��N��U��ł��傤��
�@�@�@�@�@�@�uSecurity&Trust�v�t�H�[�� 2009/3/17

�y2�z��I�u��E�W��O�i��I�u��E�Y�j

�@��u��E�W��O�́A��R��ɂȂ��\��̍��U��@��1�ŁA��N��{�^��̑J�ڂɂ�炸��̃y�[�W�ɒ��ڃA�N�Z�X��A��擾��܂��B

�@Web�A�v��P�[�V��v��O��ŁA�p��[�^�Ƃ��ăp�X��Ȃǂ��󂯓��ꂽ�ꍇ�AWeb�T�[�o�o�R�Ŗ{��A�N�Z�X��̂Ȃ��t�@�C��𗘗p�҂��擾�ł��Ă��܂��܂��B��̂Ƃ��A�l��T�[�o�̓��Ȃǂ��擾��Ă��܂��A�l��R��A�T�[�o�ւ̍U��̑��|��Ƃ��ė��p��鋰�ꂪ��܂��B