Google book mhtml injection XSS vulnerability and repair solution

Brief description:

Google book Search output has a vulnerability. You can inject script code to run it through the MHTML protocol, resulting in an XSS vulnerability. Non-original, forwarded self-white hat group system32 total.

Detailed description:

 

Proof of vulnerability:

Mhtml: http://www.google.com/books? Q = x % 250AContent-Type % 253 Amultipart % 252 frelated % 253 Bboundary % 253Dx -- x % 250AContent-Location % 253 Aajax % %%253abase64% 250d % 250a % 250d % %%253d -- x % 250A! Ajax

 

Open IE in XP ~

Solution:

This is more difficult than normal applications. filter the format of specific output content.