Excerpt -- wide character xss

Http://www.xssor.cn/sa

In fact, here baidu uses ajax to perform a series of operations, such as determining whether the URL is repeated and whether the submission is successful.
Ajax is returned in json format. The js that mainly processes the returned results isItemadd. js
Return page:

 

XML/HTML code

1. {
2. ResultNo:
3. "Duplicate url ",
4. ResultBool:
5. False,
6. ResultNum: 30005,
7. UserLogin: "1 ",
8. ItemId: "026aec1d90a1e9e5ea1182a1"
9. }

If we only analyze the HTML page, we can't see any place where we execute JS, but our small box does pop up.

This is also a typical DOM XSS

The reason is that, inItemadd. jsMedium:

JavaScript code

1. FunctionCheckForm (){
2. VarF = document. fadd, oit = f. it, oiu = f. iu, odc = f. dc, otn = f. tn, vst = 0;
3. If(F. st. checked =True)
4. Vst = 1;
5. If(Chek_submit (oit, oiu, odc, otn )){
6. VarVit = oit. value, viu = oiu. value, vdc = odc. value, vtn = otn. value, url =/Do/cm;
7. VarP_pars =Iu =+ Encode (viu) +& St =+ Encode (vst) +& Dc =+ Encode (vdc) +& It =+ Encode (vit) +& Tn =+ Encode (vtn );
8. VarPars =Ct = 5 &+ P_pars;
10. NewAjax. Request (url ,{
11. Method:Post,
12. Parameters: pars,
13. OnComplete:Function(XmlHttp ){
14. VarJsonResults =(+ XmlHttp. responseText +);
15. VarRetno = eval (jsonResults );
16. If(ParseInt (retno. userLogin) = 0 ){
17. If(Nw =True)
18. Location. href ="Http://passport.baidu.com /? Login & tpl = fa1 & next_target = _ blank & skip_ OK = 1 & u ="+ CheckUrl (location. href, 1800 );
19. ElseLocation. href ="Http://passport.baidu.com /? Login & tpl = fa & skip_ OK = 1 & u ="+ CheckUrl (location. href, 1800 );
20. Return
21. }
23. VarRetTxt = retno. resultNo;
24. VarResultNum = retno. resultNum;
26. If(RetTxt ="Duplicate url"){
27. VarItemId = retno. itemId;
29. If(Confirm ("The url is repeated. Is it overwritten? ")){
30. NewAjax. Request (url ,{
31. Method:Post,
32. & Nb