karupanerura karupanerura

Aug 11, 2014

Plack::Middleware::Session::Cookie 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server, when the middleware is enabled without a secret.

If you use Plack::Middleware::Session::Cookie, you're required to pass a secret option to the middleware. The value of the secret key must obviously be kept private.

Version 0.22 is released today, which gives you a big WARNING when it is enabled without a secret set.
Version 0.23 TRIAL is released, which refuses to run without a secret set, giving an error message on the startup. This will become a non-trial release in a few days.

Solution

Break the Web: Object static methods no longer throw errors for primitives!

Object.keys等のstaticメソッドがES6で挙動が変わったことで面倒なことになってる話

何が変わったか

ES5でプリミティブを受け取ると例外を投げていたObject.keys等のメソッドが、ES6では例外を吐かなくなった。

Object.getPrototypeOf ( O )
Object.getOwnPropertyDescriptor ( O, P )

新社会人に必須である：

勤務先との書面による「労働契約」。業務委託契約等NG。
多寡を問わず毎月払われる給料。遅配等論外である。
健康保険。
労災保険。
雇用保険。
三六協定。
年次有休。
育児休業の制度があり取得者がいる会社に勤務する。

	/**
	* Enable route to __noSuchMethod__ when unknown method calling.
	*
	* @param {Object} obj Target object.
	* @return {Object}
	*/
	function enableMethodMissing(obj) {

	var functionHandler = createBaseHandler({});
	functionHandler.get = function(receiver, name) {

	#/<?php eval('echo "PHP Code\n";'); __halt_compiler();?> /

	#include <stdio.h> /*

	print ((("b" + "0" == 0) and eval('"Perl Code\n"')) or (0 and "Ruby Code\n" or "Python Code"));

	__DATA__ = 1
	"""""
	__END__

	Backbone.Pjax = (function () {
	"use strict";

	var History = Backbone.History.extend({
	"navigate": function(fragment, options) {
	if (!Backbone.History.started) return false;
	if (!options \|\| options === true) options = {trigger: options};
	fragment = this.getFragment(fragment \|\| '');
	if (this.fragment === fragment) return;
	this.fragment = fragment;

	#!/usr/bin/env perl

	use strict;
	use warnings;
	use Plack::Request;

	# run `plackup pinknoise.psgi` and access to http://0:5000/?s=<second> via browser

	my $app = sub {
	my $req = Plack::Request->new(shift);

	// windows: gcc -o uv_streem.exe uv_streem.c -luv -lws2_32 -lpsapi -liphlpapi
	// unix: gcc -o uv_streem uv_streem.c -luv -lrt
	#include <stdio.h>
	#include <uv.h>

	struct _task_t;

	typedef void (strm_cb)(struct _task_t );

	typedef struct _strm_stream {

	package net.yanzm.profileapplication;

	import android.animation.Animator;
	import android.animation.AnimatorListenerAdapter;
	import android.animation.AnimatorSet;
	import android.animation.ObjectAnimator;
	import android.app.Activity;
	import android.app.AlertDialog;
	import android.content.DialogInterface;
	import android.content.Intent;