å±éºãšèšãããŠããã®ã¯EVAL Injectionãåçè©äŸ¡ã³ãŒãã«ããããã£ã¬ã¯ãã£ãã®äžé©åãªäžåãåå ãšããã
äžåãšã¯ãããããã€ã
ããããããã€ã³ãžã§ã¯ã·ã§ã³
javascriptã§ã¯ããããªãšïœ¢eval() ã¯å±éºã ãã䜿ããªãã§ãã ãã!ãšãŸã§èšã£ãŠããã
evalã俺ã«è§ŠããããããããïŒ åãå°å°ããŠããïŒ
ã»ãšãã©ãããªãã®äºé£ã¹ã¡ããããéããªãããšãã森ã®ããŸããã®ãããªççŸããååšã®evalããããã¯èªæèéå°ã
ããããã®è©±ãLISPããç»å Žããeval
æªãã®ã¯Evalãªãã ãããïŒ
Rubyã¯evalã«ã¹ã³ãŒãèŠçŽ ãå
¥ããããšã§äœããå
眪ïŒå
垯ããŸãïŒããããšããŠããã
MDNã§ã¯functionã代ããã«ã€ãã£ãŠãããšããã
function looseJsonParse(obj){
return Function('"use strict";return (' + obj + ')')();
}
console.log(looseJsonParse(
"{a:(4-1), b:function(){}, c:new Date()}"
))
人ã
ã¯ãªãããã»ã©ãŸã§ã«å±éºãšããããŠããevalãåŸäžã«æ®ãããšããã®ãïŒ
LISPã«ã€ããŠã¯ãbootstrapåé¡ã®è§£æ¶ãšããããšãããã
ãã®æ¬ã«ãããšjavascriptã¯Scheme(LISPç³»)ã«åœ±é¿ãåããŠãããããã®ãŸãŸevalãåŒãç¶ãã ã®ãããããªãã
evalã«ã€ããŠãååãã«æžããŠããããã¬ã³ãã³ã¢ã€ã¯ïŒé称ååã¢ã€ã¯ïŒåž«å ã¯èªã
ãã®çæéã«evalã®å¯èœæ§ãemacsãšperlããã£ã¹ãã§æã¿èŸŒããšããæ矀ãªåãå³ãèŠããååã¢ã€ã¯å
茩ãããããã©ãããã€ããã§jsã«evalé¢æ°ãæ®ã£ãŠãããã¯ããã®ããšã®åœ±é¿ãåããèšèªãªã©ãããããããããšåµå§è
ãèªããŠãmdnã¯evalãå³å»æ¢ãããå¢ãã
ãããããã¹ã±çµå¶é£ãè±æã
(define (eval-with-x prog a b)
(let ((at-a (eval `(let ((x ',a)) ,prog)))
(at-b (eval `(let ((x ',b)) ,prog))))
(- at-b at-a)))
Cèšèªã«ã¯evalã¯ãªããããã¯ãªãã
LISPã®æµããããŸãªãéããã¿ããªSHELLã«EVALãåèã«ããŠevalãçµã¿èŸŒãã ã®ã ãããããããŠãshellã»ã©æš©éãã³ã³ãã¯ã¹ãããã£ããããŠããªãã®ã§ãevalã䜿ããªãšçã¿åºããŠãããŠåãã¡ã¯åŸããå±éºã ãšèšãã®ããã·ã¶ãŒãã³ãº
Cèšèªã«ã¯evalé¢æ°ãçŽæ¥çã«ååšããªãã®ã«ã¯ããã€ãã®çç±ãèããããŸãã
äœã¬ãã«èšèªã®æ§è³ª: Cã¯äœã¬ãã«ã®èšèªã§ãããã¡ã¢ãªç®¡çãçŽæ¥çãªããŒããŠã§ã¢ã¢ã¯ã»ã¹ãå¯èœã§ãããã®ãããªèšèªã«ãããŠãã©ã³ã¿ã€ã æã«ä»»æã®ã³ãŒããåçã«è©äŸ¡ã»å®è¡ããevalã®ãããªã¡ã«ããºã ã¯ãå®å
šæ§ã®èŠ³ç¹ãããªã¹ã¯ãé«ãã§ãã
ã³ã³ãã€ã«æ¹åŒ: Cã¯ã³ã³ãã€ã«èšèªã§ããããœãŒã¹ã³ãŒãã¯å®è¡åã«æ©æ¢°èªã«ã³ã³ãã€ã«ãããŸããevalã¯éåžžãã€ã³ã¿ããªã¿èšèªã§é »ç¹ã«äœ¿çšãããæ©èœã§ãããã©ã³ã¿ã€ã æã«åçã«ã³ãŒãã解éã»å®è¡ããããšã容æãªã€ã³ã¿ããªã¿ã®ç¹æ§ãšçžæ§ãè¯ãã§ãã
è€éæ§: evalãé©åã«å®è£
ããã«ã¯ãCã®ã©ã³ã¿ã€ã ã«ã³ã³ãã€ã©ãã€ã³ã¿ããªã¿ã®äžéšãçµã¿èŸŒãå¿
èŠããããŸããããã¯éåžžã«è€éã§ãCã®ã·ã³ãã«ããå¹çæ§ã«åœ±é¿ãäžããå¯èœæ§ããããŸãã
å®å
šæ§: äžè¿°ããããã«ãevalã䜿çšãããšä»»æã®ã³ãŒããå®è¡ããããããã»ãã¥ãªãã£äžã®ãªã¹ã¯ãé«ãŸããŸããäžæ£ãªã³ãŒããæå³ããªãåäœãåŒãèµ·ããå¯èœæ§ããããããç¹ã«äœã¬ãã«èšèªã®Cã«ãããŠã¯ããã®ãããªæ©èœãé¿ããããããšãå€ãã§ãã
ç¹å®ã®ç®ç: Cèšèªã¯äž»ã«ã·ã¹ãã ããã°ã©ãã³ã°ãçµã¿èŸŒã¿ããã°ã©ã ã®éçºã®ããã«èšèšãããŸããããã®ãããªçšéã§ã¯ãevalã®ãããªåçã³ãŒãå®è¡æ©èœã¯ããŸãæ±ããããªãããšãå€ãã§ãã
ãã¡ãããç¹å®ã®ç¶æ³ãèŠæ±ã«å¿ããŠãCã§èªåã®evalã®ãããªæ©èœãå®è£
ããããšã¯æè¡çã«å¯èœã§ãïŒäŸ: å€éšã®ã³ã³ãã€ã©ãåŒã³åºããŠã³ãŒããã³ã³ãã€ã«ã»å®è¡ããïŒãããããCèšèªã®èšèšææ³ãçšéãèæ
®ãããšãæšæºã©ã€ãã©ãªã«evalãå«ãŸããŠããªãã®ã¯ç解ããããã§ãããã
Phpã¯èŠåã¬ãã«ã§éæšå¥šãã§ãã¡ããããšäœ¿ãããã©ã
Perlã¯çŠæ¢ããããšã¯ãªãã¿ããã ã£ãã
ãããã©ã¯ãã®perlããããªãã§ãã§ããã§ããããšãã£ãæã