Utf-7 bom follow-up

Today, tcpper asked me to help test a url and it seems that Microsoft has made some restrictions on the utf-7 bom in a patch.

Test in win7 + ie8:

The encoding sequence for ie to identify webpages is still charset in bom> server content-type ......

However, if charset is set in server content-type and BOM is UTF-7, charset in server content-type is dominant.

Test code:

<? Php

Header ('content-Type: text/html; charset = UTF-8 ');

Echo file_get_contents('utf7bom.txt ');

 

Among them, utf7bom.txt content: +/v8 + ADw-script + AD4-alert (1) + ADw-/script + AD4-

After access, the webpage is encoded as UTF-8, rather than the utf-7.

Of course, remove the above marked red charset = UTF-8, also to the UTF-7 bom, pop up 1.

 

By the way, the black brother page that css under the UTF-7 bombuild XSS, courier server for xxx.css content-type set to text/css; charset = UTF-8, in the current patch, the browser is still based on the UTF-7 bom. In IE, the style and link labels introduce sub-resources, regardless of the content-type settings of its sub-resources. (Didn't I forcibly check whether the conten-type of cross-origin css files is text/css to fix a vulnerability ?)

From: imread ('dark night latent Wind ')