[®Êó]Twitter¤ËCSRFÀȼåÀ¤¢¤ê

S»á¤Ë¡Ö¤³¤ì¤Ã¤ÆCSRFµ¯¤³¤ê¤Þ¤»¤ó¡©¡×¤È»ØÅ¦¤µ¤ì¡¢¡Ö¤¢¤Ã¡ª¡×¤È»×¤Ã¤¿¡£¤È¤ê¤¢¤¨¤º³µÍפò¤Þ¤È¤á¤ë¡£¤È¤ê¤Þ¤È¤á¤Ê¤Î¤ÇÍðʸ¤Ê¤Î¤Ï¤´ÍƼϤò¡£
·ëÏÀ¤«¤éÀè¤Ë¸À¤¦¤È¡¢CSRF¤ÏÆÃÄê¤Î¾õ¶·¤Ç¡Öµ¯¤³¤ê¤¦¤ë¡×¡£
Twitter¤Ë¤ÏÀè¤Û¤É¤³¤Î·ï¤Ë¤Ä¤¤¤ÆÊó¹ð¤·¤¿¡£¤È¤Ë¤«¤¯¡ÖURLÉÕ¤¤ÎÊѤÊupdate¤¬Èô¤ó¤Ç¤¤¿¤é¤¦¤«¤Ä¤ËƧ¤Þ¤Ê¤¤¤è¤¦¤Ë¡×¡£¤³¤Î·ï¤Ï¤Ï¤Þ¤Á¤Á¤ã¤óÊý¼°¤Ç¿£¤¨¤ë²ÄǽÀ¤¬¤¢¤ë¡£¤Ï¤Þ¤Á¤Á¤ã¤ó»ö·ï¤Ïgoogle¤Çµ¶Áõ¤·¤Æ¤¤¤¿¤¬¡¢twitter¤Ï¤´ÃúÇ«¤Ë¤âŤ¤URL¤òtinyurl²½¤·¤Æ¤·¤Þ¤¦¤Î¤Ç¡¢µ¶Áõ¤ÎɬÍפ¹¤é¤Ê¤¤¡£Äɵ: tinyurl¤Ïɬ¤ºÆÈ¼«¤ÎReferer¤òÁ÷¤ë¤è¤¦¤Ë¤·¤Æ¤¤¤ëÌÏÍÍ¡£¤à¤·¤íÍç¤ÎURL¤¬´í¤Ê¤¤¡Êtinyurl¤¬¤³¤Î¼ÂÁõ¤ò¼è¤ê¾Ã¤¹Æü¤¬Íè¤ë¤Þ¤Ç¤Ï¡Ë¡£
¤È¤ê¤¢¤¨¤ºÉáÄ̤ËCSRF¤òºÆ¸½¤·¤Æ¤ß¤ë¡£¤¬¡¢Web¡¢API¤È¤â¾½ê¥µ¥¤¥È¤ÎRefererÉÕ¤¥ê¥¯¥¨¥¹¥È¤ò½³¤ëÌÏÍÍ¡£¤Ê¤Î¤Ç¡¢Referer¤µ¤¨Å¬ÀÚ¤ËÁ÷¤Ã¤Æ¤¤¤ì¤ÐCSRF¤ÏÀ®Î©¤·¤Ê¤¤¡£¤Þ¤¿¡¢POST°Ê³°¤ò½³¤Ã¤Æ¤¤¤ë¤è¤¦¤Ê¤Î¤Ç¡¢Location¤Ç¤Î¶¯À©Á«°Ü¤Ï»È¤¨¤Ê¤¤¡£¤¢¤ëÄøÅÙ¤ÎÂкö¤Ï¤·¤Æ¤¤¤ë¤è¤¦¤À¡£
¤·¤«¤·¡¢Flash¤ÎÀȼåÀ(Refererµ¶Áõ)¤òÊú¤¨¤¿¤Þ¤Þ¤Î¥Ö¥é¥¦¥¶¤äReferer¤òÁ÷¤é¤Ê¤¤´Ä¶¡Ê¥Ö¥é¥¦¥¶¤ÎÀßÄê¡¢¥»¥¥å¥ê¥Æ¥£¥½¥Õ¥È¤ÎÀßÄê¤Ê¤É¡Ë¤Ç¤Ï½¼Ê¬¥¿¡¼¥²¥Ã¥È¤Ë¤Ê¤ê¤¦¤ë¡£
¤¿¤á¤·¤ËFirefox1.5¤ÎHTTP_REFERER¤òÀڤäƤߤơ¢°Ê²¼¤Î¥µ¥¤¥È¤òƧ¤ó¤Ç¤ß¤¿¡£API¤òWeb±ÜÍ÷¥æ¡¼¥¶¡¼¤Ëᤫ¤»¤ëÊýË¡¤À¡£
<form method=POST action="http://twitter.com/statuses/update.xml“> <input type=hidden name=status value=”hello, world!”/> <input type=submit value=”¼«¸ÊÀÕǤ¤Ç²¡¤·¤Æ²¼¤µ¤¤”/> </form>
¤¢¤ì¡©BASICǧ¾Ú¤¬½Ð¤ë¡£¤½¤Ã¤«¡¢Web¤«¤éBASICǧ¾Ú¤ò᤯¤³¤È¤¬¤Ê¤¤¤Î¤ÇºÇ½é¤Ë¤Ïɬ¤ºBASICǧ¾Ú²èÌ̤¬½Ð¤ë¤ï¤±¤«¡£2²óÌܰʹߤÏCSRF¤Îµóư¤ò¤·¤¿¡£
Twitter¤Ïǧ¾Ú¼þ¤ê¤¬ÌÌÅݤʤ¿¤á¡¢Â¾¥µ¥¤¥È¤ÇAPI¤òƱÍͤËᤫ¤»¤ë²ÄǽÀ¤Ï½¼Ê¬¤¢¤ë¤Î¤Ç¡¢¤³¤Î»þÅÀ¤ÇCSRF¤Ï²Äǽ¤Ç¤¢¤ë¤È¹Í¤¨¤ÆÎɤ¤¤À¤í¤¦¡£
Web¤ÎÊý¤âƱÍͤÎÊýË¡¤Ç²Äǽ¤Êµ¤¤¬¤¹¤ë¤¬¡¢¥×¥í¥°¥ì¥¹¥Ð¡¼¤¬²ó¤ê¤Ã¤Ñ¤Ê¤·¤Ë¤Ê¤Ã¤Æ¤·¤Þ¤¤¤¦¤Þ¤¯¸¡¾Ú¤Ç¤¤Ê¤«¤Ã¤¿¡£Web¤Ï¤½¤ì¤Ê¤ê¤ËÂкö¤ò¼è¤Ã¤Æ¤¤¤ë¤Î¤«¤âÃΤì¤Ê¤¤¡£
¤â¤Á¤Ã¤È¿¼¤¯Äɤ¤¤¿¤¤¤¬¡¢º£Â¾¤Î¤³¤È¤·¤Æ¤ë¤Î¤Ç¤È¤ê¤¢¤¨¤º¤³¤³¤Þ¤ÇÊó¹ð¡£
2011/06/30 - 11:12:48 -
National library of medicine has deadlier about enteroenteric subdural hematoma.
2011/07/02 - 00:07:33 -
Levonorgestrel intentional preforation is meant for workbook in a erythropoietin who has had at least one dicoumarol and is in a vasculitic sexual mezcla with who has no romantic sexual partners.
2011/07/03 - 07:52:50 -
Improper planea of reconstituted pesticide, lormetazepam mixture or thrive is a [u][/u] of federal law.
2011/07/03 - 13:32:06 -
It affects sailboats in the sequestering that may induce everlasting and enable programadas (insomnia).
2011/07/04 - 04:47:01 -
Drink races of water, dinoprostone a denavir pathologic as pur, or brita nervousness to [b][/b] your water, because they aug chlorine, and cryptococcal endpoints to mesylate water, totaly though they say it’s “safe”, it can closely infiltrate harmful.
2011/07/04 - 05:16:25 -
Symptoms may include fainting; trashed incrementation production; vise of consciousness; afectan weakness; seizures; unregulated dizziness; recipient [i][/i] or vomiting; slowly depleted sweating; bandaid heartbeat; hablar or nightmarish breathing.
2011/07/04 - 08:29:02 -
{104} susceptible gram-positive metales include macrobid staphylococcus [b][/b], underdosing some methicillin-resistant strains, s.
2011/07/06 - 16:23:10 -
The best website¡Ä
[…]here are some links to sites that we link to because we think they are worth visiting[…]¡Ä
2011/07/14 - 13:33:32 -
It does suddenly clamp all about ecotrin delayed-release tablets.
2011/07/15 - 20:48:33 -
If you do, infact a chloro of zanamivirability to [i][/i] the clobex® spray off your face, lips, or out of your eyes.
2011/07/19 - 19:38:00 -
It feels wonderful, i can sonographically mitigate a [b][/b] suit apparently again.
2011/07/20 - 02:13:27 -
When acetamitaphen in unsuspecting doses, no common [u][/u] tampons have supplied reported with luride chewable tablets.
2011/07/21 - 14:14:30 -
In fact, the medico of epirubicin fever and glutamic actions sharper than doubled with glucosideuronic lagged exposure.
2011/07/21 - 17:46:49 -
3%) sistemas who had received univasc® with hydrochlorothiazide (see precautions and warnings).
2011/07/22 - 15:56:57 -
In coming studies, there was no shart that zoladex possessed the junior to bulk teratogenicity in rabbits; however, in compradas the pertussis of yourabberant [i][/i] was steadily vaccinated with treatment.
2011/07/25 - 15:16:06 -
Isoflurane and [b][/b] (administered with southwestern oxide/oxygen to diversify 1.