-
-
Notifications
You must be signed in to change notification settings - Fork 256
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
InnerHTML的XSS攻击漏洞 #474
Comments
请教下大神,等保检测结果怎么处理? |
我也遇到了,请问下解决了吗? |
试试将 AAChartKit-Swift 更新的到最新版本 |
我全局搜索检查了一下, AAChartKit-Swift 的 参考: |
检测详情:/Payload/.app/Frameworks/AAInfographics.framework/AAJSFiles.bundle/AAHighcharts.js:k){g&&g!==d&&g.destroy&&g.destroy();delete b[k]})},discardElement:function(d){b||(b=w("div"));d&&b.appendChild(d);b.innerHTML=""},erase:function(b,d){for(var g=b.length;g--;)if(b[g]===d){b.s /Payload/.app/Frameworks/AAInfographics.framework/AAJSFiles.bundle/AAHighcharts.js:function(e){q(e,function(a,f){var h=!0;-1===c.allowedAttributes.indexOf(f)&&(h=!1);-1!==["background","dynsrc","href","lowsrc","src"].indexOf(f)&&(h=B(a)&&c.allowedReferences.some(function(c /Payload/.app/Frameworks/AAInfographics.framework/AAJSFiles.bundle/AAHighcharts.js:(new DOMParser).parseFromString(c,"text/html");else{var a=x("div");a.innerHTML=c;c={body:a}}var h=function(c,l){var e=c.nodeName.toLowerCase(),a={tagName:e};if("#text"===e){e=c.textContent|| /Payload/.app/Frameworks/AAInfographics.framework/AAJSFiles.bundle/AAHighcharts.js:function(a){this.container.className="highcharts-container "+(a||"")};a.prototype.getContainer=function(){var a=this.options,b=a.chart,d=ka(),c,e=this.renderTo;e||(this.renderTo=e=b.renderTo /Payload/***.app/Frameworks/AAInfographics.framework/AAJSFiles.bundle/AAHighcharts.js:d[g].destroy();"title subtitle chartBackground plotBackground plotBGImage plotBorder seriesGroup clipRect credits pointer rangeSelector legend resetZoomButton tooltip renderer".split(" ").fo 解决方案: 更新最新版本也能解决吗? |
描述:
DOM型XSS漏洞是基于文档对象模型(Document Object Model)的一种漏洞。它的攻击代码不需要服务器解析响应,而是通过浏览器端的DOM解析触发XSS。客户端上的JavaScript脚本可以访问浏览器的DOM并修改页面的内容,不依赖服务器的数据,直接从浏览器端获取数据并执行。在JavaScript中给DOM的innerHTML属性赋值一个<script>标签,普遍的xss注入点。如果攻击者利用该漏洞进行攻击, 5 可能会有账号或Cookie信息被窃取,从而冒充管理者登录后台进行数据篡改等恶意操作。
检测详情:
解决方案:
开发者自查:如果需要通过innerhtml获取到的页面内容与远程服务器做内容过滤及转换,建议过滤掉非法字符。示例如下:私有静态字符串
htmlEncode(char c){开关(c){ case '&': return "&"; case '<': return "<"; case '>': return """"; case '"': return """; case ' ': return " "; default: return c + ""; }}
The text was updated successfully, but these errors were encountered: