{"id":27233,"date":"2017-10-31T14:05:41","date_gmt":"2017-10-31T14:05:41","guid":{"rendered":"https:\/\/dev.railscarma.com\/preventing-security-issues-rails\/"},"modified":"2022-09-06T09:26:04","modified_gmt":"2022-09-06T09:26:04","slug":"preventing-security-issues-rails","status":"publish","type":"post","link":"https:\/\/www.railscarma.com\/ja\/%e3%83%96%e3%83%ad%e3%82%b0\/%e6%8a%80%e8%a1%93%e8%ab%96%e6%96%87\/preventing-security-issues-rails\/","title":{"rendered":"Rails \u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u306e\u9632\u6b62"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u3001Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u6210\u529f\u3068\u6301\u7d9a\u53ef\u80fd\u306a\u958b\u767a\u3092\u76ee\u6307\u3059\u958b\u767a\u8005\u306b\u3068\u3063\u3066\u5927\u304d\u306a\u61f8\u5ff5\u4e8b\u9805\u3067\u3059\u3002\u3059\u3079\u3066\u306e\u958b\u767a\u8005\u306f\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u3042\u3089\u3086\u308b\u653b\u6483\u304b\u3089\u53ef\u80fd\u306a\u9650\u308a\u5b89\u5168\u306b\u306a\u308b\u3088\u3046\u306a\u30b3\u30fc\u30c9\u3092\u4f5c\u6210\u3057\u305f\u3044\u3068\u8003\u3048\u3066\u3044\u307e\u3059\u304c\u3001100% \u306b\u30d0\u30b0\u304c\u306a\u3044\u3001\u307e\u305f\u306f\u5b89\u5168\u306a\u30b3\u30fc\u30c9\u306f\u5b58\u5728\u3057\u307e\u305b\u3093\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u958b\u767a\u8005\u306f\u3001\u653b\u6483\u306b\u5bfe\u3059\u308b\u8106\u5f31\u6027\u3092\u6700\u5c0f\u9650\u306b\u6291\u3048\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u6700\u5584\u3092\u5c3d\u304f\u3059\u5fc5\u8981\u304c\u3042\u308b\u3053\u3068\u3092\u8a8d\u8b58\u3057\u3066\u3044\u307e\u3059\u3002\u8106\u5f31\u6027\u306e\u691c\u51fa\u306f\u7c21\u5358\u3067\u3059\u304c\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u3084\u30cf\u30c3\u30ad\u30f3\u30b0\u306b\u3088\u308a\u640d\u5931\u304c\u751f\u3058\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u304c\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u306e\u958b\u59cb\u76f4\u5f8c\u304b\u3089\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u554f\u984c\u3092\u30c1\u30a7\u30c3\u30af\u3057\u3001\u9806\u8abf\u306b\u9032\u3081\u308b\u305f\u3081\u306b\u5b9a\u671f\u7684\u306a\u54c1\u8cea\u30c1\u30a7\u30c3\u30af\u3092\u5b9f\u65bd\u3059\u308b\u3053\u3068\u304c\u5e38\u306b\u826f\u3044\u7406\u7531\u3067\u3059\u3002<\/p>

1]\u30bb\u30c3\u30b7\u30e7\u30f3<\/strong><\/h3>

\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u8a55\u4fa1\u3092\u59cb\u3081\u308b\u306b\u306f\u3001\u7279\u5b9a\u306e\u653b\u6483\u306b\u5bfe\u3057\u3066\u8106\u5f31\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u30bb\u30c3\u30b7\u30e7\u30f3\u304b\u3089\u59cb\u3081\u308b\u306e\u304c\u826f\u3044\u3067\u3057\u3087\u3046\u3002<\/p>

session[:user_id] = @current_user.id User.find(session[:user_id])<\/code><\/pre>
\u2013 \u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001Ruby on Rails \u306f Cookie \u30d9\u30fc\u30b9\u306e\u30bb\u30c3\u30b7\u30e7\u30f3 \u30b9\u30c8\u30a2\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u4f55\u304b\u304c\u5909\u66f4\u3055\u308c\u306a\u3044\u9650\u308a\u3001\u30b5\u30fc\u30d0\u30fc\u4e0a\u3067\u30bb\u30c3\u30b7\u30e7\u30f3\u304c\u671f\u9650\u5207\u308c\u306b\u306a\u3089\u306a\u3044\u3053\u3068\u3092\u610f\u5473\u3057\u307e\u3059\u3002\u3064\u307e\u308a\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3084 ID \u306a\u3069\u306e\u6a5f\u5bc6\u30c7\u30fc\u30bf\u3092\u30bb\u30c3\u30b7\u30e7\u30f3\u5185\u306b\u6c7a\u3057\u3066\u4fdd\u6301\u3059\u3079\u304d\u3067\u306f\u306a\u3044\u3068\u3044\u3046\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002
\u2013 \u3057\u305f\u304c\u3063\u3066\u3001\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306f\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30d9\u30fc\u30b9\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u3059\u3002Rails \u3092\u4f7f\u7528\u3059\u308b\u3068\u975e\u5e38\u306b\u7c21\u5358\u3067\u3059 \u2013<\/p>
\u30d7\u30ed\u30b8\u30a7\u30af\u30c8::Application.config.session_store :active_record_store
\u30bb\u30c3\u30b7\u30e7\u30f3 ID \u306f\u300132 \u6587\u5b57\u306e\u30e9\u30f3\u30c0\u30e0\u306a 16 \u9032\u6587\u5b57\u5217\u3067\u3059\u3002<\/p>
\u30bb\u30c3\u30b7\u30e7\u30f3 ID \u306f\u3001OpenSSL\u3001\/dev\/urandom\u3001Win32 \u306a\u3069\u306e\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u56fa\u6709\u306e\u30e1\u30bd\u30c3\u30c9\u3092\u4f7f\u7528\u3057\u3066\u3001\u6697\u53f7\u7684\u306b\u5b89\u5168\u306a\u4e71\u6570\u3092\u751f\u6210\u3059\u308b\u30e9\u30f3\u30c0\u30e0\u306a 16 \u9032\u6587\u5b57\u5217\u3092\u751f\u6210\u3059\u308b SecureRandom.hex \u3092\u4f7f\u7528\u3057\u3066\u751f\u6210\u3055\u308c\u307e\u3059\u3002\u73fe\u6642\u70b9\u3067\u306f\u3001Rails \u306e\u30bb\u30c3\u30b7\u30e7\u30f3 ID \u306e\u30ed\u30b0\u30a4\u30f3\u8cc7\u683c\u60c5\u5831\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u653b\u6483\u3001\u3064\u307e\u308a\u8a66\u884c\u932f\u8aa4\u653b\u6483\u3092\u884c\u3046\u3053\u3068\u306f\u3067\u304d\u307e\u305b\u3093\u3002<\/p>
\u4e00\u822c\u7684\u306a\u30bb\u30c3\u30b7\u30e7\u30f3\u30d9\u30fc\u30b9\u306e\u653b\u6483\u306e\u3044\u304f\u3064\u304b\u3092\u6b21\u306b\u793a\u3057\u307e\u3059\u3002
\u30bb\u30c3\u30b7\u30e7\u30f3 \u30cf\u30a4\u30b8\u30e3\u30c3\u30af:- \u3053\u308c\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u306f\u30e6\u30fc\u30b6\u30fc\u306e\u30bb\u30c3\u30b7\u30e7\u30f3 ID \u3092\u76d7\u307f\u3001\u88ab\u5bb3\u8005\u306e\u540d\u524d\u3067 Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002
\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u56fa\u5b9a:- \u653b\u6483\u8005\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u306e\u30bb\u30c3\u30b7\u30e7\u30f3 ID \u3092\u76d7\u3080\u3060\u3051\u3067\u306a\u304f\u3001\u65e2\u77e5\u306e\u30bb\u30c3\u30b7\u30e7\u30f3 ID \u3092\u56fa\u5b9a\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u306f\u30bb\u30c3\u30b7\u30e7\u30f3\u56fa\u5b9a\u3068\u547c\u3070\u308c\u307e\u3059\u3002
\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u6709\u52b9\u671f\u9650:- \u653b\u6483\u8005\u306f\u3001\u671f\u9650\u5207\u308c\u306e\u306a\u3044\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u653b\u6483\u306e\u6642\u9593\u3092\u5ef6\u9577\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002\u30af\u30ed\u30b9\u30b5\u30a4\u30c8 \u30ea\u30af\u30a8\u30b9\u30c8 \u30d5\u30a9\u30fc\u30b8\u30a7\u30ea (CSRF)\u3001\u30bb\u30c3\u30b7\u30e7\u30f3 \u30cf\u30a4\u30b8\u30e3\u30c3\u30af\u3001\u30bb\u30c3\u30b7\u30e7\u30f3\u56fa\u5b9a\u306a\u3069\u306e\u653b\u6483\u304c\u305d\u306e\u4f8b\u3067\u3059\u3002<\/p>
2]\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/strong><\/h3>
\u653b\u6483\u8005\u304c\u30b3\u30de\u30f3\u30c9 \u30e9\u30a4\u30f3 \u30d1\u30e9\u30e1\u30fc\u30bf\u307e\u305f\u306f Unix \u30b3\u30de\u30f3\u30c9\u5168\u4f53\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u5834\u5408\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u30b3\u30de\u30f3\u30c9 \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306b\u5bfe\u3057\u3066\u8106\u5f31\u306b\u306a\u308a\u307e\u3059\u3002\u305f\u3060\u3057\u3001Rails \u3067 UNIX \u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u306f\u4e00\u822c\u7684\u3067\u306f\u306a\u3044\u305f\u3081\u3001\u3053\u306e\u3088\u3046\u306a\u653b\u6483\u304c\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u306f\u4f4e\u304f\u306a\u308a\u307e\u3059\u3002
\u4e00\u65b9\u3001\u9867\u5ba2\u30c7\u30fc\u30bf\u306b\u5bfe\u3057\u3066 Unix \u30b3\u30de\u30f3\u30c9\u3092\u76f4\u63a5\u4f7f\u7528\u3059\u308b\u30d0\u30c3\u30af\u30b0\u30e9\u30a6\u30f3\u30c9 \u30d7\u30ed\u30bb\u30b9\u3067\u8106\u5f31\u6027\u304c\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>
\u4e00\u822c\u7684\u306a Rails \u30b3\u30de\u30f3\u30c9 \u30e9\u30a4\u30f3 \u30e1\u30bd\u30c3\u30c9\u306e\u3044\u304f\u3064\u304b\u3092\u6b21\u306b\u793a\u3057\u307e\u3059\u3002
%x[\u2026]
\u30b7\u30b9\u30c6\u30e0\uff08\uff09
\u5b9f\u884c()
`…`
\u30b3\u30de\u30f3\u30c9\u3092\u9023\u9396\u3055\u305b\u308b\u65b9\u6cd5\u306f\u8907\u6570\u3042\u308a\u307e\u3059\u304c\u3001\u305d\u308c\u306f\u30db\u30b9\u30c6\u30a3\u30f3\u30b0 \u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0 \u30b7\u30b9\u30c6\u30e0\u306b\u3082\u4f9d\u5b58\u3059\u308b\u3053\u3068\u306b\u3082\u6ce8\u610f\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u4f8b: \u300c&\u300d\u3001\u300c&&\u300d\u3001\u300c|\u300d\u3001\u300c||\u300d\u7b49
\u30b3\u30de\u30f3\u30c9\u306e\u5b9f\u884c\u4e2d\u306b\u74b0\u5883\u5909\u6570\u3092\u4fdd\u8b77\u3059\u308b
Rails \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u3088\u3063\u3066\u5b9f\u884c\u3055\u308c\u308b\u30d7\u30ed\u30bb\u30b9\u306f\u3001API \u30ad\u30fc\u306a\u3069\u3067\u69cb\u6210\u3055\u308c\u308b\u89aa\u30d7\u30ed\u30bb\u30b9\u306e\u74b0\u5883\u5909\u6570\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/p>
3] SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/strong><\/h3>
SQL \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u3001SQL \u30af\u30a8\u30ea\u5185\u3067\u5b89\u5168\u306b\u4f7f\u7528\u3055\u308c\u306a\u3044\u5024\u3092\u30e6\u30fc\u30b6\u30fc\u304c\u64cd\u4f5c\u3067\u304d\u308b\u5834\u5408\u306b\u767a\u751f\u3057\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u30c7\u30fc\u30bf\u640d\u5931\u3001\u30c7\u30fc\u30bf\u6f0f\u6d29\u3001\u7279\u6a29\u306e\u6607\u683c\u306a\u3069\u306e\u671b\u307e\u3057\u304f\u306a\u3044\u7d50\u679c\u304c\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>
SQL \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u975e\u5e38\u306b\u7c21\u5358\u3067\u4e00\u822c\u7684\u306a\u653b\u6483\u3067\u3042\u308a\u3001Web \u30b5\u30a4\u30c8\u3084\u767a\u751f\u72b6\u6cc1\u306b\u3088\u3063\u3066\u306f\u3001\u305d\u306e\u5f71\u97ff\u304c\u975e\u5e38\u306b\u6df1\u523b\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>
\u958b\u767a\u8005\u3068\u3057\u3066\u3001SQL \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u304c\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u3059\u3079\u3066\u306e\u53ef\u80fd\u6027\u306b\u6ce8\u610f\u3057\u3001\u305d\u308c\u306b\u5fdc\u3058\u3066\u540c\u69d8\u306b\u51e6\u7406\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>
SQL \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u6b21\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>
Employee.all(:conditions => "\u6307\u5b9a = #{params[:\u6307\u5b9a]}")<\/code><\/pre>
\u4e0a\u8a18\u306e\u30b3\u30fc\u30c9\u306f SQL \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306b\u5bfe\u3057\u3066\u8106\u5f31\u3067\u3059\u304c\u3001\u6b21\u306e\u30b3\u30fc\u30c9\u306f SQL \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3092\u9632\u304e\u307e\u3059\u3002<\/p>
Employee.all(:conditions => ['\u6307\u5b9a = ?', params[:\u6307\u5b9a]])<\/code><\/pre>
\u307e\u305f\u306f<\/p>
Employee.all(:conditions => {:designation => params[:designation]})<\/code><\/pre>
Rails\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u5bfe\u7b56<\/strong><\/h5>
SQL \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u3059\u3079\u3066\u306e\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u30c6\u30b9\u30c8\u3059\u308b\u306e\u306f\u9000\u5c48\u306a\u4f5c\u696d\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u304c\u3001Brakeman \u306e\u3088\u3046\u306a\u9759\u7684\u30b3\u30fc\u30c9 \u30b9\u30ad\u30e3\u30ca\u30fc\u306a\u3069\u306e\u5bfe\u7b56\u3092\u8b1b\u3058\u308b\u5fc5\u8981\u304c\u3042\u308a\u3001\u3044\u304f\u3064\u304b\u306e\u5358\u4f53\u30c6\u30b9\u30c8 \u30b1\u30fc\u30b9\u3092\u4f5c\u6210\u3067\u304d\u307e\u3059\u3002
a) \u4e00\u822c\u898f\u5247:<\/strong>\u2013 \u3053\u306e\u3088\u3046\u306b\u6587\u5b57\u5217\u5909\u5316 (#{}) \u3067 params \u3092\u4f7f\u7528\u3057\u306a\u3044\u3067\u304f\u3060\u3055\u3044\u3002
\u4f8b\u3048\u3070<\/p>
User.where("name = '#{params[:name]}'")<\/code><\/pre>
b)params \u304c\u914d\u5217\u3067\u3042\u308b\u5834\u5408\u3082\u3042\u308b\u3053\u3068\u306b\u6ce8\u610f\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u6b21\u306b\u4f8b\u3092\u793a\u3057\u307e\u3059\u3002<\/strong><\/p>
?user[]=1 \u3092 URL \u306b\u8ffd\u52a0\u3057\u305f\u5834\u5408\u306f\u3001params[:user]\u3002\u30e6\u30fc\u30b6\u30fc\u306f\u5b58\u5728\u3057\u307e\u3059\u304b?\u6b21\u306b\u3001params[:user] \u306f\u30af\u30a8\u30ea SELECT 1 AS one FROM \u201cusers\u201d WHERE (1) LIMIT 1 \u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>
4] \u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0 (XSS)<\/strong><\/h3>
XSS \u3092\u5229\u7528\u3059\u308b\u3068\u3001\u653b\u6483\u8005\u306f Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u3067\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>
Rails \u30d3\u30e5\u30fc \u30b9\u30cb\u30da\u30c3\u30c8 <%= @ flat.title %> \u3092\u8003\u3048\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u30d5\u30e9\u30c3\u30c8\u306e\u30bf\u30a4\u30c8\u30eb\u304c HTML \u306e\u8ffd\u52a0\u3068\u3068\u3082\u306b\u7de8\u96c6\u3055\u308c\u305f\u5834\u5408\u3001\u3053\u306e Rails \u30d3\u30e5\u30fc\u306f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u3067\u305d\u306e HTML \u3092\u30ec\u30f3\u30c0\u30ea\u30f3\u30b0\u3057\u307e\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u30d6\u30e9\u30a6\u30b6\u306f HTML (XSS) \u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>
\u5b9f\u969b\u3001\u3053\u308c\u306f\u6700\u8fd1\u306e Rails \u3067\u306f\u307e\u3060\u6a5f\u80fd\u3057\u307e\u305b\u3093\u3002Rails \u30d0\u30fc\u30b8\u30e7\u30f3 2 \u3067\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3092\u3059\u3079\u3066\u30a8\u30b9\u30b1\u30fc\u30d7\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059: <%= h(@ flat.title) %>
\u6700\u8fd1\u3067\u306f\u3001Rails \u306b\u306f\u5404\u6587\u5b57\u5217\u306b\u3001\u5b89\u5168\u304b\u3069\u3046\u304b\u3092 HTML \u3068\u3057\u3066\u30de\u30fc\u30af\u3059\u308b\u30d5\u30e9\u30b0 (@ flat.title.html_safe?) \u304c\u4ed8\u5c5e\u3057\u3066\u3044\u307e\u3059\u3002\u5b89\u5168\u3067\u306a\u3044\u5834\u5408 (\u305f\u3068\u3048\u3070\u3001\u30d1\u30e9\u30e1\u30fc\u30bf\u3001\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306a\u3069)\u3001\u6b21\u306e\u65b9\u6cd5\u3067\u4f7f\u7528\u3057\u3066\u3044\u308b\u3068\u304d\u306b\u81ea\u52d5\u7684\u306b\u30a8\u30b9\u30b1\u30fc\u30d7\u3055\u308c\u307e\u3059: <%= @ flat.title %>
Rails 3.0 \u3067\u306f\u3001XSS \u306b\u5bfe\u3059\u308b\u4fdd\u8b77\u304c\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u52d5\u4f5c\u3067\u3059\u3002<\/p>
\u5bfe\u7b56<\/strong><\/h3>
a) \u30b3\u30f3\u30c6\u30f3\u30c4 \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30dd\u30ea\u30b7\u30fc (CSP) \u6226\u7565<\/strong><\/p>
\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30dd\u30ea\u30b7\u30fc<\/a> \u306f\u57fa\u672c\u7684\u306b HTTP \u30d8\u30c3\u30c0\u30fc\u306e\u5f62\u5f0f\u3067\u3042\u308a\u3001\u3053\u308c\u306b\u3088\u308a\u3001\u3042\u3089\u3086\u308b\u7a2e\u985e\u306e\u30a2\u30bb\u30c3\u30c8\u306b\u5bfe\u3057\u3066\u3059\u3079\u3066\u306e\u30bd\u30fc\u30b9\u304c\u8a31\u53ef\u3055\u308c\u308b\u3053\u3068\u306b\u95a2\u3059\u308b\u30eb\u30fc\u30eb\u304c\u5ba3\u8a00\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30eb\u30fc\u30eb\u306b\u5f93\u3063\u305f\u7d50\u679c\u3001\u305d\u308c\u4ee5\u5916\u306e\u30eb\u30fc\u30eb\u306f\u3059\u3079\u3066\u7981\u6b62\u3055\u308c\u307e\u3059\u3002\u9069\u5207\u306b\u5b9f\u88c5\u3059\u308b\u3068\u3001\u30a2\u30d7\u30ea\u5185\u306e\u3059\u3079\u3066\u306e\u30af\u30ed\u30b9\u30b5\u30a4\u30c8 \u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0 (XSS) \u8106\u5f31\u6027\u3092\u4e00\u6383\u3067\u304d\u307e\u3059\u3002<\/p>
b) HTML \u30bb\u30fc\u30d5\u3001ActiveSupport::SafeBuffer<\/strong><\/p>
ActiveSupport::SafeBuffer \u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u3001\u6587\u5b57\u5217\u306b HTML \u30bb\u30fc\u30d5 \u30d5\u30e9\u30b0\u3092\u8ffd\u52a0\u3059\u308b\u305f\u3081\u306b Rails 3 \u306b\u3088\u3063\u3066\u5c0e\u5165\u3055\u308c\u307e\u3057\u305f\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001\u7279\u306b\u6587\u5b57\u5217\u306b\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3084\u30d1\u30e9\u30e1\u30fc\u30bf\u306a\u3069\u306e\u5916\u90e8\u30bd\u30fc\u30b9\u304c\u3042\u308b\u5834\u5408\u306f false \u306b\u306a\u308a\u307e\u3059\u3002\u30d5\u30e9\u30b0\u306f\u300cstring\u300d.html_safe?\u3067\u8fd4\u3055\u308c\u307e\u3059\u3002<\/p>
HTML \u30a8\u30b9\u30b1\u30fc\u30d7 \u30e1\u30bd\u30c3\u30c9 h() \u306f\u3001\u6587\u5b57\u5217\u3092 HTML \u30bb\u30fc\u30d5\u3068\u3057\u3066\u30de\u30fc\u30af\u3059\u308b\u6587\u5b57\u5217\u3092\u30a8\u30b9\u30b1\u30fc\u30d7\u3057\u307e\u3059\u3002<\/p>
h("html>").html_safe? #=> true ("html>").html_safe? #=>false<\/code><\/pre>
c) OWASP (Open Web Application Security Project) XSS \u9632\u6b62<\/strong><\/p>
XSS \u3092\u9632\u6b62\u3059\u308b\u306b\u306f\u3001\u4fe1\u983c\u3067\u304d\u306a\u3044\u30c7\u30fc\u30bf\u3092\u3059\u3079\u3066\u62d2\u5426\u3057\u3001HTML \u3084\u305d\u306e\u4ed6\u306e\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8 (JavaScript\u3001CSS\u3001\u5c5e\u6027\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u306a\u3069) \u306b\u76f4\u63a5\u5165\u308c\u3089\u308c\u306a\u3044\u3088\u3046\u5236\u9650\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>
d) HAML \u30c6\u30f3\u30d7\u30ec\u30c3\u30c8\u3067\u306e XSS \u4fdd\u8b77<\/strong><\/p>
ERB \u3067\u306f\u306a\u304f Haml \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u6587\u5b57\u5217\u306f ERB \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3068\u540c\u3058\u65b9\u6cd5\u3067\u81ea\u52d5\u7684\u306b\u30a8\u30b9\u30b1\u30fc\u30d7\u3055\u308c\u307e\u3059\u3002\u307e\u305f\u3001ERB \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306e\u5834\u5408\u3068\u540c\u69d8\u306b\u3001HTML \u30bb\u30fc\u30d5\u6587\u5b57\u5217 (string.html_safe? \u306f true \u3092\u8fd4\u3059) \u306f\u81ea\u52d5\u7684\u306b\u30b9\u30ad\u30c3\u30d7\u3055\u308c\u307e\u305b\u3093\u3002 Haml \u306e != \u8868\u8a18\u306f\u3001ERB \u3067 <%= raw(\u2026) %> \u304c\u52d5\u4f5c\u3059\u308b\u3088\u3046\u306b\u52d5\u4f5c\u3059\u308b\u305f\u3081\u3001\u30a8\u30b9\u30b1\u30fc\u30d7\u3055\u308c\u3066\u3044\u306a\u3044\u30d0\u30fc\u30b8\u30e7\u30f3\u304c\u30ec\u30f3\u30c0\u30ea\u30f3\u30b0\u3055\u308c\u307e\u3059\u3002
\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001<\/p>
="\u5f37\u8abf" != "\u5f37\u8abf"<\/em><\/em><\/em><\/em><\/code><\/pre>
\u30b3\u30f3\u30d1\u30a4\u30eb\u3059\u308b\u3068\u6b21\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059:<\/p>
\u5f37\u8abf\u3055\u308c<\/em>\u305f<\/em><\/code><\/pre>
\u305d\u306e\u305f\u3081\u3001Haml \u3067 != \u3092\u4f7f\u7528\u3059\u308b\u3068\u304d\u306f\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3001\u30e6\u30fc\u30b6\u30fc \u30c7\u30fc\u30bf\u304c\u30a8\u30b9\u30b1\u30fc\u30d7\u3055\u308c\u305a\u306b\u30ec\u30f3\u30c0\u30ea\u30f3\u30b0\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002
\u4ee5\u4e0b\u306f\u3001Rails \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u958b\u767a\u4e2d\u306b\u5bfe\u51e6\u3067\u304d\u308b\u3044\u304f\u3064\u304b\u306e\u4e88\u9632\u7b56\u3067\u3059\u3002<\/p>
1]\u8a8d\u8a3c<\/strong><\/h5>
Device \u307e\u305f\u306f Authlogic gem \u3092\u4f7f\u7528\u3057\u307e\u3059\u3002
\u2013 \u8a8d\u8a3c\u3092\u6709\u52b9\u306b\u3059\u308b\u306b\u306f\u3001-> \u3092\u8ffd\u52a0\u3059\u308b\u3053\u3068\u3092\u5fd8\u308c\u306a\u3044\u3067\u304f\u3060\u3055\u3044\u3002<\/p>
\u30af\u30e9\u30b9 ProjectController < ApplicationController
before_filter :authenticate_user
\u2013 \u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001Devise \u306f\u30d1\u30b9\u30ef\u30fc\u30c9\u306b 6 \u6587\u5b57\u306e\u307f\u3092\u5fc5\u8981\u3068\u3057\u307e\u3059\u3002\u6700\u5c0f\u5024\u306f \/config\/initializers\/devise.rb \u3067\u5909\u66f4\u3067\u304d\u307e\u3059\u3002
config.password_length = 8..128
\u2013 \u30e6\u30fc\u30b6\u30fc \u30e2\u30c7\u30eb\u306b\u6b21\u306e\u30b3\u30fc\u30c9\u3092\u8ffd\u52a0\u3059\u308b\u3053\u3068\u3067\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u8907\u96d1\u3055\u3092\u5909\u66f4\u3067\u304d\u307e\u3059\u3002<\/p>
validate :password_complexity defpassword_complexity ifpassword.present?\u3067\u306f\u306a\u304f\u3001password.match(\/\\A(?=.*[az])(?=.*[AZ])(?=.*\\d).+\\z\/)errors.add :password, "\u3092\u542b\u3081\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u5c11\u306a\u304f\u3068\u3082 1 \u3064\u306e\u5c0f\u6587\u5b57\u30011 \u3064\u306e\u5927\u6587\u5b57\u3001\u304a\u3088\u3073 1 \u3064\u306e\u6570\u5b57" end end<\/code><\/pre>
2] \u5b89\u5168\u3067\u306a\u3044\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u76f4\u63a5\u53c2\u7167\u307e\u305f\u306f\u5f37\u5236\u7684\u306a\u30d6\u30e9\u30a6\u30b8\u30f3\u30b0<\/strong><\/h5>
\u2013 Ruby on Rails \u30a2\u30d7\u30ea\u306f\u3001Restful URL \u69cb\u9020\u3092\u5229\u7528\u3057\u3066\u304a\u308a\u3001\u4f7f\u7528\u3055\u308c\u308b\u30d1\u30b9\u306e\u307b\u3068\u3093\u3069\u304c\u63a8\u6e2c\u53ef\u80fd\u304b\u3064\u76f4\u611f\u7684\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u30e6\u30fc\u30b6\u30fc\u304c\u5225\u306e\u30e6\u30fc\u30b6\u30fc\u306b\u5c5e\u3059\u308b\u30c7\u30fc\u30bf\u306b\u30a2\u30af\u30bb\u30b9\u3057\u305f\u308a\u5909\u66f4\u3057\u3088\u3046\u3068\u3057\u305f\u308a\u3057\u306a\u3044\u3088\u3046\u306b\u3059\u308b\u306b\u306f\u3001\u30a2\u30af\u30b7\u30e7\u30f3\u3092\u7279\u5225\u306b\u5236\u5fa1\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u30d0\u30cb\u30e9\u306e Rails \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u306f\u3001\u3059\u3050\u306b\u4f7f\u3048\u308b\u3053\u306e\u3088\u3046\u306a\u7d44\u307f\u8fbc\u307f\u306e\u4fdd\u8b77\u6a5f\u80fd\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u3055\u3089\u306b\u3001\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u30ec\u30d9\u30eb\u3067\u624b\u52d5\u3067\u5b9f\u884c\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002
\u2013 \u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306bcancancan\u307e\u305f\u306fpandit\u3092\u4f7f\u7528\u3059\u308b<\/p>
3] \u8cea\u91cf\u306e\u5272\u308a\u5f53\u3066\u3068\u5f37\u529b\u306a\u30d1\u30e9\u30e1\u30fc\u30bf<\/strong><\/h5>
- class Project < ActiveRecord::Base attr_accessible :name, :admin end<\/code><\/pre>
\u4e0a\u8a18\u306e\u4f8b\u306b\u3088\u308c\u3070\u3001\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a admin \u5c5e\u6027\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u6b21\u306e\u3053\u3068\u304c\u6a5f\u80fd\u3057\u307e\u3059\u3002
\u2013curl -d \u201cproject[name]=triage&project[admin]=1\u201d host:port\/projects
\u2013 config.active_record.whitelist_attributes = true<\/p>
4] \u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3068\u8ee2\u9001<\/strong><\/h5>
\u2013 \u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u4f7f\u7528\u3059\u308b\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u306e\u4f7f\u7528\u306f\u907f\u3051\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002
\u4f8b:- \/\/www.example.com\/redirect?url=\/\/www.example_commerce_site.com\/checkout
\u2013 \u5236\u9650\u7684\u306a\u4fdd\u8b77\u3067\u306f\u3001:only_path \u3092\u4f7f\u7528\u3057\u307e\u3059\u3002<\/p>
begin if path = URI.parse(params[:url]).path redirect_to path endrescue URI::InvalidURIError redirect_to '\/' end<\/code><\/pre>
\u2013 \u627f\u8a8d\u3055\u308c\u305f\u30b5\u30a4\u30c8\u306e\u30cf\u30c3\u30b7\u30e5\u3092\u4fdd\u6301\u3057\u3001\u305d\u308c\u3089\u306e\u307f\u304c\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u308b\u3053\u3068\u3092\u8a31\u53ef\u3057\u307e\u3059\u3002<\/p>
5] \u52d5\u7684\u30ec\u30f3\u30c0\u30fc\u30d1\u30b9<\/strong><\/h5>
\u2013 \u4f55\u3089\u304b\u306e\u6761\u4ef6\u306b\u57fa\u3065\u3044\u3066\u30d3\u30e5\u30fc\u3092\u52d5\u7684\u306b\u30ec\u30f3\u30c0\u30ea\u30f3\u30b0\u3059\u308b\u5834\u5408\u306f\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002\u7ba1\u7406\u30d3\u30e5\u30fc\u304c\u8aad\u307f\u8fbc\u307e\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>
6] \u30af\u30ed\u30b9\u30aa\u30ea\u30b8\u30f3\u30ea\u30bd\u30fc\u30b9\u5171\u6709<\/strong><\/h5>
\u2013 \u30d5\u30a1\u30a4\u30eb\u306e\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306a\u3069\u3002
\u2013 \u53d7\u4fe1\u30b5\u30a4\u30c8\u306f\u3001\u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\u306b\u767b\u9332\u3055\u308c\u305f\u30c9\u30e1\u30a4\u30f3\u306e\u307f\u3092\u5236\u9650\u304a\u3088\u3073\u8a31\u53ef\u3057\u3001\u30ea\u30af\u30a8\u30b9\u30c8\u3082\u305d\u308c\u3089\u306e\u30c9\u30e1\u30a4\u30f3\u306e\u307f\u304b\u3089\u9001\u4fe1\u3055\u308c\u308b\u3088\u3046\u306b\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002
\u2013 OPTIONS \u30ea\u30af\u30a8\u30b9\u30c8\u306b\u5bfe\u3059\u308b\u5fdc\u7b54\u3068 POST \u30ea\u30af\u30a8\u30b9\u30c8\u306e\u4e21\u65b9\u306b Access-Control-Allow-Origin \u30d8\u30c3\u30c0\u30fc\u3082\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u30ea\u30e2\u30fc\u30c8 \u30b5\u30a4\u30c8\u307e\u305f\u306f\u53d7\u4fe1\u30b5\u30a4\u30c8\u304c\u8981\u6c42\u5143\u306e\u30c9\u30e1\u30a4\u30f3\u3092\u8a31\u53ef\u3059\u308b\u304b\u3069\u3046\u304b\u3092\u5224\u65ad\u3059\u308b\u305f\u3081\u306b\u3001OPTIONS \u8981\u6c42\u304c\u6700\u521d\u306b\u9001\u4fe1\u3055\u308c\u308b\u305f\u3081\u3067\u3059\u3002
\u2013 POST \u30ea\u30af\u30a8\u30b9\u30c8\u304c\u9001\u4fe1\u3055\u308c\u307e\u3059\u3002\u3082\u3046\u4e00\u5ea6\u8a00\u3044\u307e\u3059\u304c\u3001\u30c8\u30e9\u30f3\u30b6\u30af\u30b7\u30e7\u30f3\u304c\u6210\u529f\u3057\u305f\u3068\u8868\u793a\u3055\u308c\u308b\u305f\u3081\u306b\u306f\u3001\u30d8\u30c3\u30c0\u30fc\u3092\u8a2d\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>
7] \u30d3\u30b8\u30cd\u30b9\u30ed\u30b8\u30c3\u30af\u306e\u30d0\u30b0<\/strong><\/h5>
\u2013 \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u3001\u30d9\u30fc\u30b9\u3068\u306a\u3063\u3066\u3044\u308b\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\u306b\u95a2\u4fc2\u306a\u304f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30d0\u30b0\u306b\u3064\u306a\u304c\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u30d3\u30b8\u30cd\u30b9 \u30ed\u30b8\u30c3\u30af \u30a8\u30e9\u30fc\u3092\u542b\u3080\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u81ea\u52d5\u30c4\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3053\u306e\u3088\u3046\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30d0\u30b0\u3092\u691c\u51fa\u3059\u308b\u306e\u306f\u975e\u5e38\u306b\u96e3\u3057\u3044\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002\u30b3\u30fc\u30c9\u306e\u5b9a\u671f\u7684\u306a\u30ec\u30d3\u30e5\u30fc\u3001\u30da\u30a2 \u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u3001\u5358\u4f53\u30c6\u30b9\u30c8\u306e\u4f5c\u6210\u306a\u3069\u306e\u5b9f\u8df5\u306f\u3001\u3053\u306e\u3088\u3046\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30d0\u30b0\u306e\u767a\u751f\u3092\u6700\u5927\u9650\u306b\u56de\u907f\u3059\u308b\u306e\u306b\u5f79\u7acb\u3061\u307e\u3059\u3002<\/p>
8] \u6a5f\u5bc6\u30d5\u30a1\u30a4\u30eb<\/strong><\/h5>
\u4ee5\u4e0b\u306f\u3001Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u958b\u767a\u4e2d\u306b\u6ce8\u610f\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3044\u304f\u3064\u304b\u306e\u30d5\u30a1\u30a4\u30eb\u3067\u3059\u3002
\/config\/database.yml - \u904b\u7528\u8a8d\u8a3c\u60c5\u5831\u304c\u542b\u307e\u308c\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002
\/config\/initializers\/secret_token.rb \u2013 \u30bb\u30c3\u30b7\u30e7\u30f3 Cookie \u3092\u30cf\u30c3\u30b7\u30e5\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308b\u30b7\u30fc\u30af\u30ec\u30c3\u30c8\u304c\u542b\u307e\u308c\u307e\u3059\u3002
\/db\/seeds.rb \u2013 \u30d6\u30fc\u30c8\u30b9\u30c8\u30e9\u30c3\u30d7\u7ba1\u7406\u8005\u30e6\u30fc\u30b6\u30fc\u3092\u542b\u3080\u30b7\u30fc\u30c9 \u30c7\u30fc\u30bf\u304c\u542b\u307e\u308c\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002
\/db\/development.sqlite3 \u2013 \u5b9f\u969b\u306e\u30c7\u30fc\u30bf\u304c\u542b\u307e\u308c\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002<\/p>
9]\u6697\u53f7\u5316<\/strong><\/h5>
Ruby on Rails \u306f OS \u6697\u53f7\u5316\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u6697\u53f7\u5316\u7528\u306e\u72ec\u81ea\u306e\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u3092\u4f5c\u6210\u3059\u308b\u3053\u3068\u306f\u307b\u3068\u3093\u3069\u306a\u3044\u306f\u305a\u3067\u3059\u3002
Rails \u3092\u66f4\u65b0\u3057\u3001\u4f9d\u5b58\u95a2\u4fc2\u3092\u66f4\u65b0\u3059\u308b\u30d7\u30ed\u30bb\u30b9\u3092\u7528\u610f\u3059\u308b\u3002<\/p>
Rails \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u3092\u691c\u51fa\u3059\u308b\u30c4\u30fc\u30eb<\/strong><\/h4>
  • \u30d6\u30ec\u30fc\u30ad\u30de\u30f3<\/li>
  • \u30d0\u30f3\u30c9\u30e9\u30fc\u76e3\u67fb<\/li>
  • \u30b3\u30fc\u30c9\u30bb\u30a4\u30af::\u30c9\u30fc\u30f3<\/li>
  • \u30e9\u30c3\u30af::\u653b\u6483<\/li>
  • \u30bf\u30e9\u30f3\u30c1\u30e5\u30e9<\/li>
  • \u30cf\u30ad\u30ea\u30c4\u30fc\u30eb\u30d9\u30eb\u30c8<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t
    \u6700\u65b0\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u8cfc\u8aad\u3059\u308b<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
    \t\t\t\t\t