Welcome to WuJiGu Developer Q&A Community for programmer and developer-Open, Learning and Share
Ask a Question
Welcome To Ask or Share your Answers For Others

Categories

URL后面带#的DOM XSS如何防范

0 votes
235 views
in Technique[技术] by (71.8m points)

URL后面带#的DOM XSS如何防范

类似以下这种DOM XSS，在web服务器中日志并不显示#以后的内容，如何进行防范？
http://www.xxx.com/index.html#"'style=width:expression(alert(777));


与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Answer

0 votes
by (71.8m points)

锚点内容是不会请求到服务器的

这种只能在渲染页面时,避免直接取 window.location 用来生成页面内容.


与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
Welcome to WuJiGu Developer Q&A Community for programmer and developer-Open, Learning and Share

Just Browsing Browsing

2.1m questions

2.1m answers

62 comments

56.7k users

Most popular tags

Snow Theme by Q2A Market
Powered by Question2Answer
...