Xss murder caused by "recent visitor"

Source: Internet
Author: User

Xss murder caused by "recent visitor"

Recently, a "recent visitor" function has been roughly implemented on the homepage.

Then there are various interesting guys on my homepage:


As a professional front-end, I was attacked by xss.
In the dialog box on the homepage, I am:


When splicing the "recent visitor", I did not process the fields returned in more words.

I don't know that there will be XSS problems, but I don't pay much attention to them. I don't want to bear in mind the painful lessons.


A function is written to filter out areas with special security risks.
Here, I use js-xss. There are too many cross-site scripting (xss) situations that I have never seen before, which is definitely more than I have considered myself.

Common XSS scenarios

Data returned by the API

Just like the xss I met this time, we can say that the interface returns a value that can be defined by the user. In the future, I should perform a layer of xss processing on the data returned by the interface. This is the most common scenario. For example, the user's messages in the bullet screen, such as comment display, are too many places.

External link

In particular, libraries that reference external websites, such as js files. Malicious external users can modify the changes.

The first is my most common, so be sure to pay attention to it.

XSS for a special case

Originally, I wanted to write a function by myself, which is a simple pair of <\>/<script> </script> &! |. But I suddenly think of a special example:

A few years ago, it was very popular-[] ()! + These symbols form a javascript statement called jsfuck. It can avoid this simple filtering. As I output in the console:

Presumably, hackers will certainly have more awesome methods.
Especially in today's increasingly powerful JavaScript.
The most safe thing is createElement and append. This must be done for important pages with potential XSS risks.

Close-up of this article to prevent XSS attacks, which cannot be ignored.
Especially at work, it has the potential to cause great harm.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.