February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
338
3
부
방어
*/
const postCommands = function(req, res) {
const userCommands = req.body.commands;
userCommands.forEach((c) => {
if (!commands.includes(c)) { return res.sendStatus(400); }
});
cli.run(req.body.commands);
};
이렇게 간단한 완화로는 명령 순서나 빈도와 관련된 이슈를 해결하지 못할 수 있지만 클라이언
트가 사용하거나 최종 사용자가 호출하도록 의도하지 않은 명령을 막아준다. 거부 목록을 사용
하지 않는 이유는 애플리케이션이 계속 진화하기 때문이다. 원치 않는 수준의 기능을 사용자에
게 제공하는 새로운 명령이 추가되는 경우 거부 목록은 보안 위험으로 간주된다.
반드시 사용자 입력을 받아
CLI
에서 실행해야 한다면 항상 거부 목록 접근보다는 허용 목록 접
근을 택하자.
25.3
마치며
인젝션 공격은 데이터베이스, 그중에서도
SQL
데이터베이스에서 주로 일어난다. 적절하게 작
성한 코드와 구성이 없는 데이터베이스가 인젝션 공격에 확실히 취약한 것이 사실이기는 하지
만,
API
엔드포인트 (또는 의존성 )와 상호작용하는
CLI
도 인젝션의 희생자가 될 수 있다.
주요
SQL
데이터베이스는
SQL
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.