Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Post an Article
Welcome To Ask or Share your Answers For Others

Categories

URL后面带#的DOM XSS如何防范

0 votes
238 views
in Technique[技术] by (71.8m points)

URL后面带#的DOM XSS如何防范

类似以下这种DOM XSS，在web服务器中日志并不显示#以后的内容，如何进行防范？
http://www.xxx.com/index.html#"'style=width:expression(alert(777));


与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Reply

0 votes
by (71.8m points)

锚点内容是不会请求到服务器的

这种只能在渲染页面时,避免直接取 window.location 用来生成页面内容.


与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
OGeek|极客中国-欢迎来到极客的世界，一个免费开放的程序员编程交流平台！开放，进步，分享！让技术改变生活，让极客改变未来！ Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

Just Browsing Browsing

1.4m articles

1.4m replys

5 comments

56.7k users

Most popular tags

Snow Theme by Q2A Market
Powered by Question2Answer
...