Xss murder caused by "recent visitor"

Xss murder caused by "recent visitor"

Recently, a "recent visitor" function has been roughly implemented on the homepage.

Then there are various interesting guys on my homepage:

Also:

As a professional front-end, I was attacked by xss.
In the dialog box on the homepage, I am:

Cause

When splicing the "recent visitor", I did not process the fields returned in more words.

I don't know that there will be XSS problems, but I don't pay much attention to them. I don't want to bear in mind the painful lessons.

Solution

A function is written to filter out areas with special security risks.
Here, I use js-xss. There are too many cross-site scripting (xss) situations that I have never seen before, which is definitely more than I have considered myself.

Common XSS scenarios

Data returned by the API

Just like the xss I met this time, we can say that the interface returns a value that can be defined by the user. In the future, I should perform a layer of xss processing on the data returned by the interface. This is the most common scenario. For example, the user's messages in the bullet screen, such as comment display, are too many places.

External link

In particular, libraries that reference external websites, such as js files. Malicious external users can modify the changes.

The first is my most common, so be sure to pay attention to it.

XSS for a special case

Originally, I wanted to write a function by myself, which is a simple pair of <\>/<script> </script> &! |. But I suddenly think of a special example:

A few years ago, it was very popular-[] ()! + These symbols form a javascript statement called jsfuck. It can avoid this simple filtering. As I output in the console:

Presumably, hackers will certainly have more awesome methods.
Especially in today's increasingly powerful JavaScript.
The most safe thing is createElement and append. This must be done for important pages with potential XSS risks.

Close-up of this article to prevent XSS attacks, which cannot be ignored.
Especially at work, it has the potential to cause great harm.