Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

server的XSS安全问题 #18

Open
allen-hu-666 opened this issue Oct 27, 2017 · 1 comment
Open

server的XSS安全问题 #18

allen-hu-666 opened this issue Oct 27, 2017 · 1 comment

Comments

@allen-hu-666
Copy link

如果有人在消息里面输入下面这些信息会很有意思：

<img src='../content/emoji/22.gif' onload='alert("你们被我的XSS攻击！哈哈哈哈")' />这是一个攻击的消息！

建议作者把信息转义一下，直接innerHTML消息出来非常不安全
@allen-hu-666
Copy link
Author

更缺德的攻击：
<img src='../content/emoji/22.gif' onload='alert("你们被我的XSS攻击！准备迎接崩溃吧！哈哈哈哈");for(var i=0;i>=0;i++){}' />这是一个攻击的消息！

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@allen-hu-666