How does IE process meta steam Encoding & amp; that's 100 + xss

How does linx2008IE process the meta steam code & the 100 + xss

 

[Origin]

Recently, hei *** has published more than 100 xss on all major websites. This does exist. The problem lies in the IE encoding policy for processing meta steam.

 

Principle]

How does IE deal with meta steam? Here is a demo:

 

[A. php]

<Style src = "a. php? Filedeska.css "charset =" gbk "> </style>

 

[A. php? File+a.css]

Header: Content-Type: text/html; charset = big5

+/V8

Body {

Xxx: expressi + AG8AbgAoA -- (window. x = 123456 )? 1 :( x = 123456 ));

}

 

Steps:

1. When IE renders a. php, it encounters loading <style src = "a. php? For the request of filedeska.css, the encoding defined by iefor a.css is default: UTF-8.

2. When IE explains charset = "gbk", the.css encoding is changed from default: UTF-8 to gbk.

3. How does IE read a. php? When the http header "Content-Type: text/html; charset1_big5133" is returned, the.css encoding is changed from gbk to big5.

4. IE Get a. php? After file=a.css outputs the body, check whether the first few bytes are fffe or +/v * -- if it is fffe, the encoding is converted to unicode; if it is +/v *, the encoding is converted to utf-7.

5. If the steam is a css document loaded by the style label, it will detect the @ charset mark. If yes, it will be converted to the corresponding encoding of @ charset.

 

[Cause]

1. Text storage xss

Http://hitn.bdimg.com/linx2008/css/item/8e4c24973277cc6d54fb9668.css

 

+/V8

Body {

Xxx: expressi + AG8AbgAoA -- (window. x = 123456 )? 1 :( x = 123456 ));

}

(Open hi.baidu.com/linx2008/home, then enter javascript:alert (x);) There is a demo on heig ** blog.

 

2. json "callback" parameter (100 + xss source)

Http://apps.hi.baidu.com/dashan/data/status? Asyn = 1 & callback = [utf-7 header] [utf-7 data stream ]......

 

[Solution]

Method 1: For json scenarios, set header: Content-Type: "json"

Method 2: do not set the first symbol of the text output to "+ ".

Eg: Add a space in front of the data output body or return it. Alternatively, filter the parameter output starting with "+.