The following are their string rules:
1, < (script|link|style|iframe) (. | \ n) *<\/\1>\s*
2, \s*on[a-z]+\s*=\s* ("[^"]+ "|") [^']+'| [^\s]+) \s* (?=>)
3, \s* (HREF|SRC) \s*=\s* ("\s* (javascript|vbscript): [^"]+ "|] \s* (javascript|vbscript): [^ ']+ ' | (javascript|vbscript): [^\s]+) \s* (?=>)
4, epression\ (. | \ n) *\);?
After understanding their rules, catching worms is a ripe move.
<textarea id= "runcode86199" > <textarea id= "bug" cols= "" "rows=" "> <button id=" Kick "> Catching worms 1</button > <script> function kickbug (str) {return str.replace/< (script|link|style|iframe) (. | \ n) *\/\1>\s*/ig, ""); } </script> <iframe></iframe> <link href= ' test.css ' ></link> <style> a {height:e Xpression (Alert (' hei ')); } </style> </textarea> <button id= "kick" > Scratch 1</button> <script> function kickbug (str) { Return Str.replace (/< (Script|link|style|iframe) (. | \ n) *\/\1>\s*/ig, ""); } if (!/msie/i.test (navigator.useragent)) {htmlelement.prototype.__definegetter__ ("innertext", function () {return This.textcontent; }); htmlelement.prototype.__definesetter__ ("InnerText", function (text) {this.textcontent = text; }); } document.getElementById ("Kick"). onclick = function () {var bug = document.getElementById ("bug"); Bug.innertext = Kickbug (Bug.innertext); } </script> </textarea>
[Ctrl + A All SELECT Note: If the need to introduce external JS need to refresh to perform]
<textarea id="runcode77913"><textarea id= "bug" cols= "rows=" 5 "> Test </textarea> <button id=" kick "> Catch bug 2</button> &l t;script> function Kickbug (str) {return str.replace (/<[a-z][^>]*\s*on[a-z]+\s*=[^>]+/ig,function $0,$1 {return $0.replace (/\s*on[a-z]+\s*=\s*) ("[^"]+ "|] [^']+'| [^\s]+) \s*/ig, ""); }); } if (!/msie/i.test (navigator.useragent)) {htmlelement.prototype.__definegetter__ ("innertext", function () {return This.textcontent; }); htmlelement.prototype.__definesetter__ ("InnerText", function (text) {this.textcontent = text; }); } document.getElementById ("Kick"). onclick = function () {var bug = document.getElementById ("bug"); Bug.innertext = Kickbug (Bug.innertext); } </script></textarea>
[Ctrl + A All SELECT Note: If the need to introduce external JS need to refresh to perform]
<textarea id="runcode55887"><textarea id= "bug" cols= "rows=" 5 "> Test </textarea> <button id=" kick "> Catch bug 3</button> &l t;script> function Kickbug (str) {return str.replace (/<[a-z][^>]*\s* (HREF|SRC) \s*=[^>]+/ig,function ($, $ {$ = $0.replace (/&# (6[5-9]|[) 78][0-9]|9[0789]|1[01][0-9]|12[012]);? /g,function ($0,$1) {return String.fromCharCode ($);}); Return $0.replace (/\s* (HREF|SRC) \s*=\s* ("\s* (javascript|vbscript): [^"]+ "|" \s* (javascript|vbscript): [^ ']+ ' | (javascript|vbscript): [^\s]+)/ig, ""); }); } if (!/msie/i.test (navigator.useragent)) {htmlelement.prototype.__definegetter__ ("innertext", function () {return This.textcontent; }); htmlelement.prototype.__definesetter__ ("InnerText", function (text) {this.textcontent = text; }); } document.getElementById ("Kick"). onclick = function () {var bug = document.getElementById ("bug"); Bug.innertext = Kickbug (Bug.innertext); } </script></textarea>
[Ctrl + A All SELECT Note: If the need to introduce external JS need to refresh to perform]
<textarea id="runcode95408"><textarea id= "bug" cols= "rows=" 5 "> Expression () Test </textarea> <button id=" kick "> Catch bug 4</ button> <script> function Kickbug (str) {return str.replace (/<[a-z][^>]*\s*style\s*=[^>]+/ig, function ($0,$1) {$ = $0.replace (/&# (6[5-9]|[ 78][0-9]|9[0789]|1[01][0-9]|12[012]);? /g,function ($0,$1) {return String.fromCharCode ($);}); Return $0.replace (/\s*style\s*=\s* ("[^"]+ (expression) [^ "]+" |] [^ ']+\2[^ ']+ ' | [^\s]+\2[^\s]+) \s*/ig, ""); }); } if (!/msie/i.test (navigator.useragent)) {htmlelement.prototype.__definegetter__ ("innertext", function () {return This.textcontent; }); htmlelement.prototype.__definesetter__ ("InnerText", function (text) {this.textcontent = text; }); } document.getElementById ("Kick"). onclick = function () {var bug = document.getElementById ("bug"); Bug.innertext = Kickbug (Bug.innertext); } </script></textarea>
[Ctrl + A All SELECT Note: If the need to introduce external JS need to refresh to perform]
This call can be
K1 (K2 (K3 (K4 (str)))
This is simply filtering the script, the so-called "dangerous script" should be able to determine which belong to the "dangerous" script, not dangerous do not filter on ... That's a tricky one, the equivalent of a firewall.
