下面是他們的字串規則：
1、<(script|link|style|iframe)(.|\n)*<\/\1>\s*
2、\s*on[a-z]+\s*=\s*("[^"]+"|'[^']+'|[^\s]+)\s*(?=>)
3、\s*(href|src)\s*=\s*("\s*(javascript|vbscript):[^"]+"|'\s*(javascript|vbscript):[^']+'|(javascript|vbscript):[^\s]+)\s*(?=>)
4、epression\((.|\n)*\);?
瞭解他們的規則後，抓蟲行動就水到渠成。
<textarea id="bug" cols="80" rows="16"> <button id="kick">抓蟲1</button> <script> function kickBug(str) { return str.replace(/<(script|link|style|iframe)(.|\n)*\/\1>\s*/ig,""); } </script> <iframe></iframe> <link href='test.css'></link> <style> a { height:expression(alert('hei')); } </style> </textarea> <button id="kick">抓蟲1</button> <script> function kickBug(str) { return str.replace(/<(script|link|style|iframe)(.|\n)*\/\1>\s*/ig,""); } if(!/msie/i.test(navigator.userAgent)){ HTMLElement.prototype.__defineGetter__("innerText",function(){ return this.textContent; }); HTMLElement.prototype.__defineSetter__("innerText",function(text){ this.textContent = text; }); } document.getElementById("kick").onclick = function() { var bug = document.getElementById("bug"); bug.innerText = kickBug(bug.innerText); } </script>
[Ctrl+A 全選 注:如需引入外部Js需重新整理才能執行]
<textarea id="bug" cols="80" rows="5"> test </textarea> <button id="kick">抓蟲2</button> <script> function kickBug(str) { return str.replace(/<[a-z][^>]*\s*on[a-z]+\s*=[^>]+/ig,function($0,$1){ return $0.replace(/\s*on[a-z]+\s*=\s*("[^"]+"|'[^']+'|[^\s]+)\s*/ig,""); }); } if(!/msie/i.test(navigator.userAgent)){ HTMLElement.prototype.__defineGetter__("innerText",function(){ return this.textContent; }); HTMLElement.prototype.__defineSetter__("innerText",function(text){ this.textContent = text; }); } document.getElementById("kick").onclick = function() { var bug = document.getElementById("bug"); bug.innerText = kickBug(bug.innerText); } </script>
[Ctrl+A 全選 注:如需引入外部Js需重新整理才能執行]
<textarea id="bug" cols="80" rows="5"> test </textarea> <button id="kick">抓蟲3</button> <script> function kickBug(str) { return str.replace(/<[a-z][^>]*\s*(href|src)\s*=[^>]+/ig,function($0,$1){ $0 = $0.replace(/&#(6[5-9]|[78][0-9]|9[0789]|1[01][0-9]|12[012]);?/g,function($0,$1){return String.fromCharCode($1);}); return $0.replace(/\s*(href|src)\s*=\s*("\s*(javascript|vbscript):[^"]+"|'\s*(javascript|vbscript):[^']+'|(javascript|vbscript):[^\s]+)/ig,""); }); } if(!/msie/i.test(navigator.userAgent)){ HTMLElement.prototype.__defineGetter__("innerText",function(){ return this.textContent; }); HTMLElement.prototype.__defineSetter__("innerText",function(text){ this.textContent = text; }); } document.getElementById("kick").onclick = function() { var bug = document.getElementById("bug"); bug.innerText = kickBug(bug.innerText); } </script>
[Ctrl+A 全選 注:如需引入外部Js需重新整理才能執行]
<textarea id="bug" cols="80" rows="5"> expression() test </textarea> <button id="kick">抓蟲4</button> <script> function kickBug(str) { return str.replace(/<[a-z][^>]*\s*style\s*=[^>]+/ig,function($0,$1){ $0 = $0.replace(/&#(6[5-9]|[78][0-9]|9[0789]|1[01][0-9]|12[012]);?/g,function($0,$1){return String.fromCharCode($1);}); return $0.replace(/\s*style\s*=\s*("[^"]+(expression)[^"]+"|'[^']+\2[^']+'|[^\s]+\2[^\s]+)\s*/ig,""); }); } if(!/msie/i.test(navigator.userAgent)){ HTMLElement.prototype.__defineGetter__("innerText",function(){ return this.textContent; }); HTMLElement.prototype.__defineSetter__("innerText",function(text){ this.textContent = text; }); } document.getElementById("kick").onclick = function() { var bug = document.getElementById("bug"); bug.innerText = kickBug(bug.innerText); } </script>
[Ctrl+A 全選 注:如需引入外部Js需重新整理才能執行]
這樣調用就可以
k1(k2(k3(k4(str))))
這樣就是單純地過濾指令碼而已，所謂過濾“危險指令碼”應該是能夠判斷哪些屬於“危險"指令碼，不危險的就不過濾才對……那可就難辦了，相當於防火牆了。
