Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
在前台申请友链的时候在url地址输入javascript:alert('xss');//http
在后台查看的时候.点击这个url就会触发.
public function setUrlAttribute($value) { // 如果没有http 则补上http if (strpos($value, 'http') === false) { $value = 'http://' . $value; } $this->attributes['url'] = strtolower(rtrim($value, '/')); }
代码里判断URL时,只判断了字符串里面是否有http,没有则在开头位置拼接http。 没有判断字符串在http的位置,javascript:alert('xss');//http 那这样就绕过了,应该判断http要在字符串开始位置出现.
The text was updated successfully, but these errors were encountered:
Add format_url function (#118)
format_url
82db13a
7f42081
多谢反馈; 如果管理员在后台点击有问题的 URL 确实会被攻击; 修复了哈;
Sorry, something went wrong.
No branches or pull requests
在前台申请友链的时候在url地址输入javascript:alert('xss');//http

在后台查看的时候.点击这个url就会触发.

代码里判断URL时,只判断了字符串里面是否有http,没有则在开头位置拼接http。
没有判断字符串在http的位置,javascript:alert('xss');//http 那这样就绕过了,应该判断http要在字符串开始位置出现.
The text was updated successfully, but these errors were encountered: