{ "schemaVersion": "1.0.0", "kind": "editorial-inspection-pack", "provenance": "editorial-guidance", "guideId": "input-and-uploads", "updatedAt": "2026-11-12", "catalogVersion": "0.11.0", "sourceRepository": "https://github.com/sakimyto/security-knowledge", "sourceLicense": "MIT", "catalogHash": "e99906d58134e7e0d33d994548277ae7814000d92c088aa5894c49b62ae60cca", "catalogReviewedAt": "2026-11-09", "execution": "read-only-by-default", "selectedRuleIds": ["SEC-010", "SEC-015"], "deferredRuleIds": [ "SEC-001", "SEC-002", "SEC-003", "SEC-004", "SEC-005", "SEC-006", "SEC-007", "SEC-008", "SEC-009", "SEC-011", "SEC-012", "SEC-013", "SEC-014", "SEC-016" ], "outsideSelectionStatus": "unverified", "resultStatuses": ["finding", "no-finding", "not-applicable", "unverified"], "reportSchemaUrl": "https://sakimyto.com/security-data/report.schema.json", "reportExampleUrl": "https://sakimyto.com/security-data/report.example.json", "catalogDiscoveryUrl": "https://sakimyto.com/security-data/discovery.json", "distributionIndexUrl": "https://sakimyto.com/security-learning-data/index.json", "requiredRuleIndex": [ { "id": "SEC-001", "hash": "efec3489e1663249a2aff75cdb7c25e82d9765acb2bdcfa31e8ee934f12ef626" }, { "id": "SEC-002", "hash": "1398f1a8c28e4441472ef3a0952fde97c4ff19b5010178989f4ddd05b6a193dd" }, { "id": "SEC-003", "hash": "00aa6c368be21452c79e662728102938d7d3896073e53de74ea5fc913250b808" }, { "id": "SEC-004", "hash": "4c8742376f6fe13cb33908f282d1a6af6fd73ae0a13007f8013ca7042fd629b4" }, { "id": "SEC-005", "hash": "695e2e119a1364887732e6ee90c1250d22063f1e6e0ec71746e80b7231ace15f" }, { "id": "SEC-006", "hash": "a3cc524b847c5ec9223ea64ed01920283062fe3fcd0eaf2595bde44f951eed71" }, { "id": "SEC-007", "hash": "154186523c183ea0ec0059b951eb9b35f0ac41557c28df13c071663be3aef6ee" }, { "id": "SEC-008", "hash": "ab2bd7e87128a2ce571578558337ab8577fcda20f841171dba5b45d732ad2f03" }, { "id": "SEC-009", "hash": "8b9d4f314306ca656f73c115c195d84dd803e8a58a53355ed03516b330b26cb2" }, { "id": "SEC-010", "hash": "66b39f4eb8a0f334e98e9388e3f9dab27415e726c0862f0b6a4a4dd10e5e81df" }, { "id": "SEC-011", "hash": "3ae198ddd5fa82a53bcbca648d3a9070b03e3cd5665387e69e50c6bb6d365cb3" }, { "id": "SEC-012", "hash": "2da99baf28980f61385469445d6c000edb5434471a4a3500f1775ca78467824a" }, { "id": "SEC-013", "hash": "630183526a6d030807db345f6214176c12ca911fb261bde3abebc1c355a21d98" }, { "id": "SEC-014", "hash": "d9142da38fbe305f72d506a6d6c3c97f658fa446587dc9b27657622c880c1163" }, { "id": "SEC-015", "hash": "1dfd83077658a79d47897d199f646eb9f69aa4d92c7646c57f2b82a715fde44c" }, { "id": "SEC-016", "hash": "cce435bbacb6fef88c9e9d661222b081d8463e4f025448a7796cdcddd7548488" } ], "boundary": { "ja": "選択した2ルールだけを、許可された対象で読み取り点検します。残る14ルールは実行せず、既存の結果形式へunverifiedと範囲外の理由を残します。資料を読むだけで合格にせず、秘密の実値・変更・外部送信の権限は増やしません。", "en": "Inspect only the two selected rules in authorized scope, read-only. Leave the other fourteen unperformed and report them as unverified with an out-of-scope reason under the existing contract. Reading guidance is not a pass and grants no authority to expose secrets, modify systems, or send data." }, "guide": { "id": "input-and-uploads", "title": { "ja": "受け取った入力が、何に使われるかを見る", "en": "Trace input into queries and file processing" }, "lead": { "ja": "SQLを作る箇所と、ファイルを保存・処理する箇所を、入口から追います。", "en": "Follow inputs from entry points to SQL construction and file storage or processing." }, "situation": { "ja": "検索・並び順・アップロードなど、外部入力を受け付ける機能があるとき。", "en": "Use this for features accepting external input, such as search, sorting, or file uploads." }, "goal": { "ja": "入力がデータとして扱われる場所と、実行や構造を決める場所を分けます。", "en": "Distinguish data handling from the code and configuration that determine structure or execution." }, "ruleIds": ["SEC-010", "SEC-015"], "incidentIds": ["moveit-2023", "conoha-wing-2026"], "termIds": ["parameter-binding", "authorization", "asset"], "sourceIds": ["sql", "upload"], "steps": [ { "title": { "ja": "入口から利用先をたどる", "en": "Trace entry points to consumers" }, "action": { "ja": "検索語、構造の選択、ファイルの受取口から、DBや保存・処理先までのコードを読みます。", "en": "Read the paths from values, structural choices, and upload entry points to their database or processing consumers." }, "evidence": { "ja": "入力元と、値・構造・保存先の対応。", "en": "Input origins mapped to values, structural choices, and stores." } }, { "title": { "ja": "値と構造を分けて読む", "en": "Separate values from structure" }, "action": { "ja": "SQLの値の束縛と固定の選択肢を確かめ、アップロード先の実行権限も確認します。", "en": "Review SQL bindings and fixed structural choices, then examine execution permissions at upload destinations." }, "evidence": { "ja": "DB呼び出し、選択肢、保存と実行の分離を示す参照。", "en": "References showing database calls, permitted choices, and separation of storage from execution." } }, { "title": { "ja": "試験した境界を確認する", "en": "Review tested boundaries" }, "action": { "ja": "既存の拒否・形式・容量・権限のテストを読み、対象になっていない経路を残します。", "en": "Review existing rejection, format, size, and permission tests and record paths outside their coverage." }, "evidence": { "ja": "入力の種類、処理先、既存試験の対象範囲。", "en": "Input types, processing destinations, and existing test scope." } } ], "limits": [ { "ja": "閉じた製品の内部にSQLの欠陥があると推測せず、提供元の対象版へ照合します。", "en": "Do not infer SQL flaws inside a closed product; use the vendor’s affected-version guidance." }, { "ja": "攻撃用の入力や実行ファイルを、許可のない相手や本番へ送る点検にはしません。", "en": "Do not send attack inputs or executable probes to unauthorized targets or production." } ], "takeaway": { "ja": "入口で文字を調べるだけでなく、実際に使う場所でどう扱うかを確認します。", "en": "Review how input is handled where it is consumed, as well as at the entry point." } }, "rules": [ { "rule": { "id": "SEC-010", "version": "1.1.1", "updatedAt": "2026-10-12", "title": { "ja": "外部入力とSQLの組み立てを確認する", "en": "Inspect external input and SQL construction" }, "summary": { "ja": "自社でSQLを実行するコードを持つ環境。閉じた製品は内部実装を推測せず、SEC-001の製品点検へ渡します。", "en": "Owned code executing SQL. For closed-source products, use SEC-001 instead of guessing internal implementation." }, "category": "implementation", "surfaces": ["web-app", "data-store"], "applicability": { "ja": "自社でSQLを実行するコードを持つ環境。閉じた製品は内部実装を推測せず、SEC-001の製品点検へ渡します。", "en": "Owned code executing SQL. For closed-source products, use SEC-001 instead of guessing internal implementation." }, "targets": [ { "ja": "API入力・検索条件・データアクセス層", "en": "API inputs, query parameters, data access layer" }, { "ja": "raw SQL・文字列連結・動的識別子", "en": "Raw SQL, string concatenation, dynamic identifiers" } ], "checks": [ { "ja": "入力が値としてバインドされるか、SQLの構文へ直接連結されないか追跡する。", "en": "Trace whether input is bound as data rather than concatenated into SQL syntax." }, { "ja": "動的な列名やソート指定は許可リストで扱い、代表・境界・不正入力を合成データで検証する。", "en": "Allow-list dynamic identifiers and sort options; test representative, boundary, and malformed inputs using synthetic data." } ], "remediation": [ { "ja": "値はパラメータ化し、識別子には許可リストを使う。必要な検索動作を保つ回帰テストを追加する。", "en": "Parameterize values, allow-list identifiers, and add regression tests preserving required queries." } ], "completionEvidence": [ { "ja": "不正入力がSQL構造を変えず、許可された操作だけが成立するテストを残す。", "en": "Record tests showing hostile input cannot alter query structure and only allowed operations succeed." } ], "limitations": [ { "ja": "MOVEitは製品側の欠陥の事例です。このルールはそこから導いた一般点検であり、同じ実装原因を自社コードへ断定しません。", "en": "MOVEit is a vendor-defect example. This editorial rule does not claim the same implementation flaw exists in your code." } ], "incidentIds": [ "anthropic-cyber-evals-2026", "anthropic-unintended-model-actions-2026", "gyazo-2026", "metabase-2026", "moveit-2023" ], "references": [ { "title": "OWASP SQL Injection Prevention Cheat Sheet", "url": "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html" } ], "execution": "read-only-by-default", "provenance": "editorial-guidance" }, "example": { "ruleId": "SEC-010", "scenario": { "ja": "自社コードが検索語や並び順を受け取り、SQLを作っているアプリ。", "en": "Application-owned code builds SQL from search values and sort choices." }, "firstCheck": { "ja": "入力を受け取る場所から、実際のDB呼び出しまでを読みます。", "en": "Read the path from input handling to the actual database call." }, "lookAt": [ { "ja": "SQLの構造を決めるコード。", "en": "Code determining SQL structure." }, { "ja": "値をDB APIへ束縛する箇所。", "en": "Value bindings supplied to the database API." }, { "ja": "列名や並び順を選ぶ固定の対応表。", "en": "Fixed mappings for column names and sort choices." } ], "evidence": { "ja": "構造と値を分けた呼び出しと、構造の選択肢を制限する箇所を記録します。", "en": "Record where values are bound separately and structural choices are constrained." }, "limit": { "ja": "認可の正しさは別に確認します。閉じた製品の内部実装は推測せず、対象版の点検へ進めます。", "en": "Authorization remains a separate check. Do not infer closed-product internals; review affected versions instead." }, "sourceIds": ["sql"] } }, { "rule": { "id": "SEC-015", "version": "1.0.0", "updatedAt": "2026-10-09", "title": { "ja": "アップロードしたファイルの実行を制限する", "en": "Restrict execution of uploaded files" }, "summary": { "ja": "利用者や外部システムから受け取るファイルの保存先と、実行できる範囲を点検します。", "en": "Inspect storage and execution boundaries for files received from users or external systems." }, "category": "configuration", "surfaces": ["web-app", "cloud", "data-store"], "applicability": { "ja": "ファイルのアップロード、取り込み、保存、配信を行うサービス。", "en": "Services that upload, ingest, store, or serve files." }, "targets": [ { "ja": "アップロードの保存先、配信設定、実行ハンドラー、処理用アカウントの権限", "en": "Upload storage, serving configuration, executable handlers, and processing-account privileges." } ], "checks": [ { "ja": "保存先がアプリの実行領域やコード配布先と重ならないか、設定と構成を照合する。", "en": "Compare configuration and architecture to check whether upload storage overlaps application or code deployment paths." }, { "ja": "保存したファイルをプログラムとして実行できる経路と、別の環境へ到達する権限を確認する。", "en": "Identify paths that could execute stored files and privileges reaching other environments." }, { "ja": "所有者が許可した検証環境の試験結果を確認する。証拠がなければunverifiedとし、攻撃用ファイルを本番へ送らない。", "en": "Review tests from an owner-authorized environment. Without evidence, mark unverified; do not submit attack files to production." } ], "remediation": [ { "ja": "ファイルの保存・配信とコード実行を分離し、保存先の実行ハンドラーと不要な権限を取り除く。", "en": "Separate storage and serving from code execution; remove executable handlers and unnecessary privileges." } ], "completionEvidence": [ { "ja": "保存先で実行が拒否される設定と試験証拠、通常の保存・配信が成功する試験証拠を残す。", "en": "Record configuration and test evidence of denied execution and successful normal storage and serving." } ], "limitations": [ { "ja": "拡張子の制限だけでは実行の可否を確認できません。画像処理ライブラリや変換処理の脆弱性は別に照合します。", "en": "Filename restrictions alone do not prove non-execution. Review image-processing and conversion-library vulnerabilities separately." }, { "ja": "このルールへの接続は点検の提案です。アップロード機能が事故の侵入原因だったという認定ではありません。", "en": "This link is inspection guidance; it does not establish uploads as the intrusion cause." } ], "incidentIds": [ "chiba-biodiversity-2026", "conoha-wing-2026", "inkrevolution-payment-2025", "pickleballone-plugin-2026", "saga-hirakawaya-payment-2026", "scala-iask-2026" ], "references": [], "execution": "read-only-by-default", "provenance": "editorial-guidance" }, "example": { "ruleId": "SEC-015", "scenario": { "ja": "利用者がファイルを送り、サービスが保存・配信・加工するアプリ。", "en": "An application accepts files and stores, serves, or processes them." }, "firstCheck": { "ja": "受取口から保存先、処理する実行環境までの設定を読みます。", "en": "Read the configuration from upload entry through storage and processing." }, "lookAt": [ { "ja": "許可する形式と容量の扱い。", "en": "Handling of permitted formats and sizes." }, { "ja": "保存先と配信・実行を分ける設定。", "en": "Separation of storage, serving, and execution." }, { "ja": "処理アカウントと保存ファイルの権限。", "en": "Processor identity and stored-file permissions." } ], "evidence": { "ja": "どの入力をどこへ保存し、どの主体が実行・参照できるかを残します。", "en": "Record where accepted input is stored and which identities can read or execute it." }, "limit": { "ja": "拡張子やContent-Typeだけでは内容を保証しません。点検のために実行可能なファイルを本番へ送りません。", "en": "Extensions and Content-Type alone do not establish content safety. Do not upload executable probes to production." }, "sourceIds": ["upload"] } } ], "referenceIncidents": [ { "id": "moveit-2023", "title": { "ja": "MOVEit：公開前のSQLインジェクション悪用", "en": "MOVEit: SQL injection exploited before disclosure" }, "organization": "Progress MOVEit customers", "summary": { "ja": "MOVEit TransferのSQLインジェクション脆弱性が、公表前から悪用されました。調査ではWebシェルの設置とデータ窃取が確認され、更新だけでなく侵害調査が必要でした。", "en": "A MOVEit Transfer SQL injection vulnerability was exploited before disclosure. Investigators observed web shells and data theft, requiring investigation alongside updates." }, "occurredAt": "2023-05-27", "disclosedAt": "2023-05-31", "reviewedAt": "2026-10-02", "outcome": "confirmed-breach", "categories": ["zero-day", "implementation"], "cves": ["CVE-2023-34362"], "claims": [ { "topic": "entry", "text": { "ja": "調査で確認された最も早い悪用の証拠は2023年5月27日でした。", "en": "The earliest exploitation evidence in Mandiant response engagements was May 27, 2023." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "Overview" }, { "topic": "weakness", "text": { "ja": "製品のSQLインジェクション脆弱性はCVE-2023-34362として公表されました。", "en": "The product SQL injection vulnerability was identified as CVE-2023-34362." }, "status": "confirmed", "sourceIds": ["s2"], "locator": "CVE-2023-34362" } ], "timeline": [ { "date": "2023-05-27", "text": { "ja": "調査で確認された悪用の証拠。", "en": "Earliest observed exploitation in the cited investigation." }, "sourceIds": ["s1"] }, { "date": "2023-05-31", "text": { "ja": "開発元が脆弱性を公表。", "en": "Vendor disclosed the vulnerability." }, "sourceIds": ["s3"] } ], "reportedActions": [ { "topic": "guidance", "text": { "ja": "開発元は利用者に緩和策と修正版の適用を案内しました。", "en": "The vendor supplied mitigation and patch guidance to customers." }, "status": "confirmed", "sourceIds": ["s3"], "locator": "Customer response" } ], "prevention": { "classification": "pre-disclosure-exploitation", "assessment": { "ja": "公表前の侵害に、後から公開されたパッチを適用できなかった責任は付けられません。公開範囲の制限と侵害時の調査・復旧も点検します。", "en": "A later patch cannot prevent an earlier compromise. Inspect exposure controls and incident investigation and recovery paths." }, "sourceIds": ["s1", "s2", "s3"] }, "ai": { "status": "unknown", "assessment": { "ja": "参照した一次情報に、攻撃でAIを利用したことを裏付ける記述はありません。AI不使用を意味しません。", "en": "The cited primary sources do not establish AI involvement. This does not establish that AI was absent." } }, "unknowns": [ { "ja": "個別の被害組織がいつ侵害されたかは一様ではありません。自社実装のSQL注入と製品側の欠陥を区別します。", "en": "Victim timelines vary. Distinguish a vendor defect from SQL injection in your own code." } ], "sources": [ { "id": "s1", "title": "Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft", "url": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft", "publisher": "Mandiant", "kind": "investigator", "publishedAt": "2023-06-02", "reviewedAt": "2026-10-02" }, { "id": "s2", "title": "CVE-2023-34362 Detail", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34362", "publisher": "NIST NVD", "kind": "government", "publishedAt": "2023-06-02", "reviewedAt": "2026-10-02" }, { "id": "s3", "title": "An Update on the Steps We are Taking to Protect MOVEit Customers", "url": "https://www.progress.com/blogs/update-steps-we-are-taking-protect-moveit-customers", "publisher": "Progress", "kind": "vendor", "publishedAt": null, "reviewedAt": "2026-10-02" } ], "ruleIds": ["SEC-001", "SEC-006", "SEC-010"] }, { "id": "conoha-wing-2026", "organization": "ConoHa WING", "title": { "ja": "ConoHa WING：不正アクセスの経緯と影響", "en": "ConoHa WING: unauthorized access and impact" }, "summary": { "ja": "一部Webサーバー領域に不正アクセスされ、不正プログラムを設置されました。原因の技術詳細は未公表です。 426アカウントのサーバー領域が対象です。会員・契約・支払い情報は別環境にあり、漏洩していないと説明しています。", "en": "Some hosted web-server areas were accessed and malicious programs installed; technical entry details are undisclosed. 426 hosting accounts are affected; separately stored membership, contract and payment information is reported unaffected." }, "occurredAt": "2026-09-03", "disclosedAt": "2026-09-20", "reviewedAt": "2026-10-09", "outcome": "confirmed-breach", "categories": ["unknown"], "cves": [], "claims": [ { "topic": "entry", "text": { "ja": "一部Webサーバー領域に不正アクセスされ、不正プログラムを設置されました。原因の技術詳細は未公表です。", "en": "Some hosted web-server areas were accessed and malicious programs installed; technical entry details are undisclosed." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "§§1-3" }, { "topic": "impact", "text": { "ja": "426アカウントのサーバー領域が対象です。会員・契約・支払い情報は別環境にあり、漏洩していないと説明しています。", "en": "426 hosting accounts are affected; separately stored membership, contract and payment information is reported unaffected." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "§§1-3" } ], "timeline": [ { "date": "2026-09-03", "text": { "ja": "公表資料が示す事象発生日。", "en": "Event date reported by the source." }, "sourceIds": ["s1"] }, { "date": "2026-09-20", "text": { "ja": "公表資料で確認できる開示日。", "en": "Disclosure date established by the reviewed notice." }, "sourceIds": ["s1"] } ], "reportedActions": [ { "topic": "response", "text": { "ja": "9月18日までに影響範囲を特定して不正プログラムを排除し、対象者へ個別に連絡しました。", "en": "The scope was determined and malicious programs removed by September 18; affected customers were individually contacted." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "§§1-3" } ], "prevention": { "classification": "unknown", "assessment": { "ja": "侵入方法や修正の提供時期が分からず、防げたかは判断できません。関連ルールで権限、取得ログ、保存期限と稼働設定を点検します。", "en": "Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules." }, "sourceIds": ["s1"] }, "ai": { "status": "unknown", "assessment": { "ja": "確認した公表資料からは、攻撃者によるAI利用を判断できません。", "en": "The reviewed disclosures do not establish attacker use of AI." } }, "unknowns": [ { "ja": "具体的な侵入方法、攻撃開始日、取得の確定範囲は未公表です。", "en": "The initial entry mechanism and prior patch availability are unknown. Hosting and membership/billing systems have separate scopes." } ], "sources": [ { "id": "s1", "title": "ConoHa WING：事故に関する公表資料", "url": "https://www.conoha.jp/wing/news/?ap=2015054834&btn_id=www_rspnet_jp--p5050_post20260920a170000g", "publisher": "ConoHa WING", "kind": "organization", "publishedAt": null, "reviewedAt": "2026-10-09" } ], "ruleIds": ["SEC-008", "SEC-009", "SEC-013", "SEC-015"] } ], "terms": [ { "id": "parameter-binding", "name": { "ja": "SQLの値の受け渡し", "en": "Parameter binding" }, "meaning": { "ja": "SQLの構造と値を分け、値をデータとして渡す方法。列名や並び順などの構造の選択とは扱いが異なります。", "en": "Passing values separately from SQL structure. Structural choices such as column names and sort directions need a different control." }, "question": { "ja": "値を渡す前に、入力をSQLの文字列へつないでいませんか。", "en": "Is input concatenated into SQL before the value is bound?" }, "ruleId": "SEC-010", "sourceId": "sql" }, { "id": "authorization", "name": { "ja": "操作できる範囲", "en": "Authorization" }, "meaning": { "ja": "利用者が、その対象に、その操作をしてよいかを決めること。ログインできることとは別の判断です。", "en": "The decision about whether a caller may perform a particular action on a particular resource, separate from establishing their identity." }, "question": { "ja": "対象を別の利用者や組織に変えても、同じ判断が働きますか。", "en": "Does the decision still hold when the resource belongs to another user or organization?" }, "ruleId": "SEC-014", "sourceId": "authorization" }, { "id": "asset", "name": { "ja": "守る対象", "en": "Asset" }, "meaning": { "ja": "サービス、保存先、管理アカウントなど、点検の対象になるもの。持ち主と用途を一緒に記録します。", "en": "A service, store, or administrative identity included in the review. Record its owner and purpose as well as its name." }, "question": { "ja": "どの環境の、誰が管理する対象を見ていますか。", "en": "Which environment and owner does this asset belong to?" }, "ruleId": "SEC-006", "sourceId": "attack-surface" } ], "sources": [ { "id": "sql", "title": "SQL Injection Prevention Cheat Sheet", "publisher": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html", "locator": "Parameterized Queries; Allow-List Input Validation", "reviewedAt": "2026-11-12" }, { "id": "upload", "title": "File Upload Cheat Sheet", "publisher": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html", "locator": "File Storage Location; Filesystem Permissions", "reviewedAt": "2026-11-12" } ] }