
ð«STOP evalé¢æ° å±éºããã°ã©ãã³ã°
å±éºãšèšãããŠããã®ã¯EVAL Injectionãåçè©äŸ¡ã³ãŒãã«ããããã£ã¬ã¯ãã£ãã®äžé©åãªäžåãåå ãšããã
ãœãããŠã§ã¢ãäžæµã³ã³ããŒãã³ãããå ¥åãåãåãããåçè©äŸ¡åŒã³åºãïŒevalãªã©ïŒã§å ¥åã䜿çšããåã«ã³ãŒãæ§æãäžå(neutralizes)ããŠããªãããŸãã¯èª€ã£ãŠäžåããŠããã
äžåãšã¯ãããããã€ã
ã€ã³ãžã§ã¯ã·ã§ã³ã®åé¡ã¯ãå€çš®å€æ§ãªåé¡ãå«ãã§ããŸãããã®ããããããã®åŒ±ç¹ã«ã€ããŠè°è«ããæãå¹æçãªæ¹æ³ã¯ãããããã€ã³ãžã§ã¯ã·ã§ã³ã®åŒ±ç¹ãšããŠåé¡ããæ確ãªç¹åŸŽã«æ³šç®ããããšã§ããæãéèŠãªåé¡ã¯ããã¹ãŠã®ã€ã³ãžã§ã¯ã·ã§ã³åé¡ã«ã¯å ±éç¹ããããšããããšã§ã--ããªãã¡ãå¶åŸ¡ãã¬ãŒã³ã®ããŒã¿ããŠãŒã¶ãŒãå¶åŸ¡ããããŒã¿ãã¬ãŒã³ã«ã€ã³ãžã§ã¯ã·ã§ã³ããããšãã§ãããšããããšã§ãã
ã€ãŸããæ£åœãªããŒã¿ã»ãã£ãã«ãéããŠã³ãŒããéã蟌ãããšã§ãããã»ã¹ã®å®è¡ãå€æŽããããšãã§ããã®ã§ãã
ãããã¡ãªãŒããŒãããŒãä»ã®å€ãã®æ¬ é¥ããå®è¡ãåŸãããã«äœããã®åé¡ãããã«å©çšããããšã䌎ãã®ã«å¯Ÿããã€ã³ãžã§ã¯ã·ã§ã³åé¡ã¯ããŒã¿ã解æããã ãã§ããããã®ã«ããŽãªãŒã®åŒ±ç¹ã®æãå€å žçãªäŸã¯ãSQLã€ã³ãžã§ã¯ã·ã§ã³ãšãã©ãŒãããæååè匱æ§ã§ããã
ããããããã€ã³ãžã§ã¯ã·ã§ã³
CVE-2022-2054
Python ã³ã³ãã€ã©ã eval() ã䜿ã£ãŠæªæã®ããæååã Python ã³ãŒããšããŠå®è¡ãã
CVE-2021-22204
ãã§ãŒã³: EXIF ããã»ããµã³ãŒãã®æ£èŠè¡šçŸãæååã®çµç«¯ãæ£ãã決å®ããŠããã (CWE-625)ãeval ã€ã³ãžã§ã¯ã·ã§ã³ (CWE-95) ãå¯èœã«ããŠããŸããã
CVE-2021-22205
é£é: ããã¯ã¹ã©ãã·ã¥ã®åŸã«æ¹è¡ãç¶ããšãæ€èšŒã¹ããã(CWE-20)ããã€ãã¹ãããevalã€ã³ãžã§ã¯ã·ã§ã³(CWE-95)ãå¯èœã«ãªãã
CVE-2008-5071
PHP ããã°ã©ã ã«ããã eval ã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2002-1750
Perl ããã°ã©ã ã«ããã eval ã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2008-5305
Perl ããã°ã©ã ã«ãããããã€ãã³ãšæ°åã®ã¿ãå«ãã¹ã ID ã䜿çšãã Eval ã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2002-1752
Perl ã® eval é¢æ°ãžã®ãã€ã¬ã¯ãã³ãŒãã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2002-1753
Perl ããã°ã©ã ãžã® eval ã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2005-1527
Perl eval é¢æ°ãžã®ãã€ã¬ã¯ãã³ãŒãã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2005-2837
Perl eval é¢æ°ãžã®çŽæ¥ã³ãŒãã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2005-1921
MFV. ãã¹ããããã¹ãã§ã¯ãªããã¹ããããæ§é ã䜿çšãããPHP eval æãžã®ã³ãŒãã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2005-2498
MFV. ãã¹ããããã¹ãã§ã¯ãªããã¹ããããæ§æã䜿çšãããPHP eval æãžã®ã³ãŒãã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2005-3302
ãã©ãŒãããããããã¡ã€ã«ã®ãã£ãŒã«ããã Python ã® eval æãžã®ã³ãŒãã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2007-1253
Python ããã°ã©ã ã«ããã eval ã€ã³ãžã§ã¯ã·ã§ã³ã
CVE-2001-1471
ãã§ãŒã³ïŒ eval ã€ã³ãžã§ã¯ã·ã§ã³ã®çµæãç¡å¹ãªå€ã«ãã£ãŠå€æ°ã®åæåã劚ããããæ»æè ã«ãã£ãŠå€æŽããã åŸã§ PHP ã® eval æã«ã€ã³ãžã§ã¯ã·ã§ã³ãããå¯èœæ§ããããŸãã
CVE-2007-2713
ãã§ãŒã³ïŒ ãªãã€ã¬ã¯ãåŸã®å®è¡ã eval ã€ã³ãžã§ã¯ã·ã§ã³ãèªçºããã
javascriptã§ã¯ããããªãšïœ¢eval() ã¯å±éºã ãã䜿ããªãã§ãã ãã!ãšãŸã§èšã£ãŠããã
eval() ã¯åŒã³åºãå ã®æš©éã§æž¡ãããã³ãŒããå®è¡ããå±éºãªé¢æ°ã§ããæªæã®ãã第äžè ã«åœ±é¿ãåããå¯èœæ§ã®ããæåå㧠eval() ãå®è¡ãããšãããªãã®ãŠã§ãããŒãž / æ¡åŒµæ©èœã®æš©éã§ãŠãŒã¶ãŒã®ãã·ã³äžã§æªæã®ããã³ãŒããå®è¡ããŠããŸãå¯èœæ§ããããŸãã
ãã°ãã®ç ã¯ãããªããåšãã®äººãèºãããèè¡æ§å¿çŸæ£ãè³åäžã«ãªãå±éºæ§ãé«ããŸãã
evalã俺ã«è§ŠããããããããïŒ åãå°å°ããŠããïŒ
ã»ãšãã©ãããªãã®äºé£ã¹ã¡ããããéããªãããšãã森ã®ããŸããã®ãããªççŸããååšã®evalããããã¯èªæèéå°ã
äž»äººå ¬ã森ãåºãéäžã«ã°ã£ãããšçã«åºäŒããïŒãäºãã«èŠåã£ãŠãšããéšåãããæè©ãããïŒåã¯éããªãã®ãïŒãéãæã£ãŠããªãããã ãã©ãšçããèšãããŠãäž»äººå ¬ãèµ°ãåºããŠçãè¿œããããŠããã
ãæŒé»ã®ç¿Œããšãããã£ã©ãæŒããããäžäºç ãã®ç·åçåŸããªã«ã«ãéšæå±ãæ°Žè²ã®é«ªã«å°æã§è¯å¥¢ãªäœæ Œãç¹åŸŽã§ãè ã«ã¯ãã¡ãã·ã§ã³ã§å 垯ãå·»ãïŒæ¬äººæ°ãåãå°å°ããŠããïŒã
ããããã®è©±ãLISPããç»å Žããeval
LISPã¯evalãæåã«ç»å Žããèšèªã§ãããevalã®å®è£ ã«ãã£ãŠãæåã®LISPã€ã³ã¿ããªã¿ãçŸããã®ã§ããããã以åã¯ãLISPã®åŒã¯ã³ã³ãã€ã«ãããŠããããããäžåºŠevalãå®è£ ããããšãããã¯åçŽãªå ¥åã»è©äŸ¡ã»åºåã®ã«ãŒã (REPL) ã®äžéšãšããŠäœ¿ãããããã«ãªããæåã®LISPã€ã³ã¿ããªã¿ã®åºç€ã圢äœã£ããLISPã®åŸã®ããŒãžã§ã³ã®evalã¯ã³ã³ãã€ã©ãšããŠãå®è£ ãããŠããã
æªãã®ã¯Evalãªãã ãããïŒ
Rubyã¯evalã«ã¹ã³ãŒãèŠçŽ ãå ¥ããããšã§äœããå 眪ïŒå 垯ããŸãïŒããããšããŠããã
éèŠãªç¹ãšããŠãIASãã·ã³ã¯ããã°ã©ã ãšããŒã¿ãã²ãšã€ã®ã¡ã¢ãªã«æ··åšãããããšãæå³ããã»ãŒæåã®èšèšã§ããã
MDNã§ã¯functionã代ããã«ã€ãã£ãŠãããšããã
function looseJsonParse(obj){
return Function('"use strict";return (' + obj + ')')();
}
console.log(looseJsonParse(
"{a:(4-1), b:function(){}, c:new Date()}"
))
人ã ã¯ãªãããã»ã©ãŸã§ã«å±éºãšããããŠããevalãåŸäžã«æ®ãããšããã®ãïŒ
ç§éã¯ç«è¬åº«ã®äžãéé»æ°ã«ãã泚æããŠæ©ãã®ã«ãã¢ã³ã¿ãã¡ã¯ã¿ãã³ããã«ããŠæ©ããšèšãã
LISPã«ã€ããŠã¯ãbootstrapåé¡ã®è§£æ¶ãšããããšãããã
ããŒãã¹ãã©ããåé¡ (Bootstrap problem) ã¯ãã³ã³ãã€ã©ãã³ã³ãã€ã«å¯Ÿè±¡ã®ããã°ã©ãã³ã°èšèªã§äœæããéã«ããã®ã³ã³ãã€ã©ã®æåã®ã³ã³ãã€ã«ãã©ãããããšãã£ãå Žåãå žåçãªäŸãšããããããããé¶ãšåµãã®åœ¢ãããã»ã«ããã¹ãã£ã³ã°ç°å¢ã®åé¡ãæããããã解決ããããã®æ¹åŒãããŒãã¹ãã©ããæ¹åŒãšããããã®åé¡ãäœãšãããŠæåã®å®åããç°å¢ãäœãããšãããŒãã¹ãã©ããã³ã°ãšãã
ãã®æ¬ã«ãããšjavascriptã¯Scheme(LISPç³»)ã«åœ±é¿ãåããŠãããããã®ãŸãŸevalãåŒãç¶ãã ã®ãããããªãã
evalã«ã€ããŠãååãã«æžããŠããããã¬ã³ãã³ã¢ã€ã¯ïŒé称ååã¢ã€ã¯ïŒåž«å ã¯èªã
å®å šãªåçã¹ã³ãŒããšããã®ã¯å ¥ããŠãŸããã§ãããã¹ããŒã«ãã³ã¯Emacsã«ãšã£ãŠéèŠãªãã®ã ãšãã ãã£ãŠãElispãããã§æºãããŸããããJavascriptã¯æŠãéçã¹ã³ãŒããæã¡ãå€å°å€åçãªãšããããããŸããéåžžã«åçã«ãªãæãç©Žãããã®ã§ããã°ããŒãã«ãªããžã§ã¯ããšãwithæãšãevalã§ãããããmy以åã®Perlã®ãã©ãŒå€æ°ããTclã®upvarãuplevelã¿ãããªã®ãšã¯éããŸããïŒïŒå¹Žä»£ã«ã¯ãããªã®ããããããã£ãŠãæµè¡ã ã£ãã®ã§ããïŒãã¬ã³ãã³ã»ã¢ã€ã¯ãcoders at workPïŒïŒïŒïŒ
ãã®çæéã«evalã®å¯èœæ§ãemacsãšperlããã£ã¹ãã§æã¿èŸŒããšããæ矀ãªåãå³ãèŠããååã¢ã€ã¯å 茩ãããããã©ãããã€ããã§jsã«evalé¢æ°ãæ®ã£ãŠãããã¯ããã®ããšã®åœ±é¿ãåããèšèªãªã©ãããããããããšåµå§è ãèªããŠãmdnã¯evalãå³å»æ¢ãããå¢ãã
Netscapeã®çµå¶é£ã¯ããã«ãã¢ã€ã¯ãJavaã«äŒŒãæ§æãæã¡ãSchemeãä»ã®æ¢åã®ã¹ã¯ãªããèšèªã«äŒŒãŠããªãæ°ããèšèªãèæ¡ããããšãæè¯ã®éžæè¢ã ãšå€æããŸããã
ãããããã¹ã±çµå¶é£ãè±æã
(define (eval-with-x prog a b)
(let ((at-a (eval `(let ((x ',a)) ,prog)))
(at-b (eval `(let ((x ',b)) ,prog))))
(- at-b at-a)))
Cèšèªã«ã¯evalã¯ãªããããã¯ãªãã
LISPã®æµããããŸãªãéããã¿ããªSHELLã«EVALãåèã«ããŠevalãçµã¿èŸŒãã ã®ã ãããããããŠãshellã»ã©æš©éãã³ã³ãã¯ã¹ãããã£ããããŠããªãã®ã§ãevalã䜿ããªãšçã¿åºããŠãããŠåãã¡ã¯åŸããå±éºã ãšèšãã®ããã·ã¶ãŒãã³ãº
Cèšèªã«ã¯evalé¢æ°ãçŽæ¥çã«ååšããªãã®ã«ã¯ããã€ãã®çç±ãèããããŸãã
äœã¬ãã«èšèªã®æ§è³ª: Cã¯äœã¬ãã«ã®èšèªã§ãããã¡ã¢ãªç®¡çãçŽæ¥çãªããŒããŠã§ã¢ã¢ã¯ã»ã¹ãå¯èœã§ãããã®ãããªèšèªã«ãããŠãã©ã³ã¿ã€ã æã«ä»»æã®ã³ãŒããåçã«è©äŸ¡ã»å®è¡ããevalã®ãããªã¡ã«ããºã ã¯ãå®å šæ§ã®èŠ³ç¹ãããªã¹ã¯ãé«ãã§ãã
ã³ã³ãã€ã«æ¹åŒ: Cã¯ã³ã³ãã€ã«èšèªã§ããããœãŒã¹ã³ãŒãã¯å®è¡åã«æ©æ¢°èªã«ã³ã³ãã€ã«ãããŸããevalã¯éåžžãã€ã³ã¿ããªã¿èšèªã§é »ç¹ã«äœ¿çšãããæ©èœã§ãããã©ã³ã¿ã€ã æã«åçã«ã³ãŒãã解éã»å®è¡ããããšã容æãªã€ã³ã¿ããªã¿ã®ç¹æ§ãšçžæ§ãè¯ãã§ãã
è€éæ§: evalãé©åã«å®è£ ããã«ã¯ãCã®ã©ã³ã¿ã€ã ã«ã³ã³ãã€ã©ãã€ã³ã¿ããªã¿ã®äžéšãçµã¿èŸŒãå¿ èŠããããŸããããã¯éåžžã«è€éã§ãCã®ã·ã³ãã«ããå¹çæ§ã«åœ±é¿ãäžããå¯èœæ§ããããŸãã
å®å šæ§: äžè¿°ããããã«ãevalã䜿çšãããšä»»æã®ã³ãŒããå®è¡ããããããã»ãã¥ãªãã£äžã®ãªã¹ã¯ãé«ãŸããŸããäžæ£ãªã³ãŒããæå³ããªãåäœãåŒãèµ·ããå¯èœæ§ããããããç¹ã«äœã¬ãã«èšèªã®Cã«ãããŠã¯ããã®ãããªæ©èœãé¿ããããããšãå€ãã§ãã
ç¹å®ã®ç®ç: Cèšèªã¯äž»ã«ã·ã¹ãã ããã°ã©ãã³ã°ãçµã¿èŸŒã¿ããã°ã©ã ã®éçºã®ããã«èšèšãããŸããããã®ãããªçšéã§ã¯ãevalã®ãããªåçã³ãŒãå®è¡æ©èœã¯ããŸãæ±ããããªãããšãå€ãã§ãã
ãã¡ãããç¹å®ã®ç¶æ³ãèŠæ±ã«å¿ããŠãCã§èªåã®evalã®ãããªæ©èœãå®è£ ããããšã¯æè¡çã«å¯èœã§ãïŒäŸ: å€éšã®ã³ã³ãã€ã©ãåŒã³åºããŠã³ãŒããã³ã³ãã€ã«ã»å®è¡ããïŒãããããCèšèªã®èšèšææ³ãçšéãèæ ®ãããšãæšæºã©ã€ãã©ãªã«evalãå«ãŸããŠããªãã®ã¯ç解ããããã§ãããã
Phpã¯èŠåã¬ãã«ã§éæšå¥šãã§ãã¡ããããšäœ¿ãããã©ã
èŠå
eval() ã¯éåžžã«å±éºãªèšèªæ§é ã§ãã ãšããã®ããä»»æã® PHP ã³ãŒããå®è¡ã§ããŠããŸãããã§ãã ããã䜿ãããšã¯ããããããŸããã ããããæ€èšããçµæã©ãããŠã䜿ããããåŸãªããªã£ãå Žåã¯ã现å¿ã®æ³šæãæã£ãŠäœ¿ããŸãããã ãŠãŒã¶ãŒããåãåã£ãããŒã¿ããã®ãŸãŸæž¡ããŠã¯ãããŸããã æž¡ãåã«ãé©åãªæ€èšŒãå¿ èŠã§ãã
Perlã¯çŠæ¢ããããšã¯ãªãã¿ããã ã£ãã
ãããã©ã¯ãã®perlããããªãã§ãã§ããã§ããããšãã£ãæã
ãããªãšæã£ããå¿æŽãããïŒ
