Reflected XSS vulnerability and repair of Sina Weibo live broadcasting component

Sina Weibo http://widget.weibo.com/live broadcast components under the XSS vulnerability.
Detailed description:
 
Live Video components are generally used by other websites, such as embedded
 
<Iframe src = http://widget.weibo.com/livestream/listlive.php? Language = zh_cn & width = 242 & height = 290 & uid = 1459831275 & skin = 1 & refer = 1 & pic = 1 & titlebar = 0 & border = 0 & publish = 1 & atalk = 1 & recomm = 1 & at = 1 & atopic = 111 & ptopic = 1111 & dpc = 1> </iframe>
 
This page does not strictly filter the refer_content, so it can be xss. This may cause some security risks to other websites using this component.
Proof of vulnerability: www.2cto.com
 
Access xxxxx/sina1.html? S = </script> <script> alert (document. domain) </script>
The code is:
 
<Iframe src = http://widget.weibo.com/livestream/listlive.php? Language = zh_cn & width = 242 & height = 290 & uid = 1459831275 & skin = 1 & refer = 1 & pic = 1 & titlebar = 0 & border = 0 & publish = 1 & atalk = 1 & recomm = 1 & at = 1 & atopic = 111 & ptopic = 1111 & dpc = 1> </iframe>
 
Then the weibo domain is displayed.
 
Solution:
 
Security code
 
 
From d4rkwind @ wooyun