[{"data":1,"prerenderedAt":230},["ShallowReactive",2],{"article-XSS攻击应对方案":3},{"title":4,"article":5,"hot_article":16,"month_arch":79,"cover":227},"XSS攻击应对方案 - 独孤影的博客",{"id":6,"title":7,"uri":7,"author":8,"tags":9,"created_at":13,"view_count":14,"content":15},24,"XSS攻击应对方案","duguying",[10,11,12],"XSS","攻击","跨站脚本攻击","2014-12-14 19:39:48",6825,"\u003Cp>XSS(Cross Site Scripting)，跨站脚本攻击，简单来说就是用户获取到了页面脚本执行的权限，够获取到JS脚本执行权限后能干的事情很多，比如盗取session id，从而实现登录帐号从而获取账户相关信息。\u003Cbr\u002F>\u003C\u002Fp>\u003Cp>XSS攻击一般都是出现在有富文本提交的表单中，用户可以在提交的富文本中按以下各种方法插入JavaScript脚本：\u003C\u002Fp>\u003Cpre class=\"brush:html;toolbar:false\"><script>alert("hacked!");<\u002Fscript>\u003C\u002Fpre>\u003Cpre class=\"brush:html;toolbar:false\"><img src=".\u002F" onerror="alert('hacked!');">\u003C\u002Fpre>\u003Cpre class=\"brush:html;toolbar:false\"><a href="javascript:alert('hacked!')">foo<\u002Fa>\u003C\u002Fpre>\u003Cpre class=\"brush:html;toolbar:false\"><style>\ndiv{\n  background: url("javascript:alert('hacked!');");\n}\n<\u002Fstyle>\u003C\u002Fpre>\u003Cp>以及其他的各种方法在页面执行Js脚本，当然黑客执行脚本的目的并不是为了弹窗装逼，而是读取当前用户的cookies，从而获取session id，达到非法登录用户账户的目的，简单来说就是不要密码盗号。\u003Cbr\u002F>\u003C\u002Fp>\u003Cp>嵌入式web页面富文本编辑器很多，例如ueditor等，有人以为防范XSS攻击是这些编辑器的事情，事实上XSS攻击并不是这些编辑器能够阻止得了的，因为黑客是可以绕过编辑器提交表单的，所以防范XSS攻击的重点是后台字符串过滤，将非法的串过滤掉，当然还有另外一种办法，那就是使用第三方替代标签，如UBB标签(discuz中使用的就是这个)、Markdown等，不直接使用HTML系列的标签由其他标签转换为HTML，从而达到防止非法注入脚本的目的。\u003C\u002Fp>\u003Cp>事实上富文本提交攻击防范远不止XSS这些，XSS主要是指Js脚本的攻击，可是有一种不致命却很糟糕的攻击却是被忽略了，那就是css脚本扰乱界面布局，事实上这应该算是纯粹的捣乱，可是却也能够严重的影响到页面的美观以及用户的正常使用，开源中国就曾经被大家用这种方法玩坏过。\u003C\u002Fp>\u003Cpre class=\"brush:html;toolbar:false\"><div style="display:block;position:fixed;width:100%;height:100%;background-color:red;"><\u002Fdiv>\u003C\u002Fpre>\u003Cp>上面的代码便可以让整个网页变成红色。\u003Cbr\u002F>\u003C\u002Fp>\u003Cp>因此，我个人认为html富文本的过滤不仅仅是简单的Js过滤，应当连css一起过滤掉。或者干脆使用第三方标签UBB等。\u003C\u002Fp>",{"title":17,"list":18},"最热文章",[19,25,31,37,43,49,55,61,67,73],{"id":20,"title":21,"uri":22,"author":8,"created_at":23,"view_count":24},28,"docker容器目录与主机目录同步","\u002Farticle\u002Fdocker容器目录与主机目录同步","2014-12-31 12:34:08",15573,{"id":26,"title":27,"uri":28,"author":8,"created_at":29,"view_count":30},21,"beego中使用fis","\u002Farticle\u002Fbeego中使用fis","2014-12-03 10:47:56",9253,{"id":32,"title":33,"uri":34,"author":8,"created_at":35,"view_count":36},20,"用github登录，oauth开发","\u002Farticle\u002F用github登录，oauth开发","2014-11-23 13:33:37",9115,{"id":38,"title":39,"uri":40,"author":8,"created_at":41,"view_count":42},18,"windows服务注册工具nssm","\u002Farticle\u002Fwindows服务注册工具nssm","2014-10-31 21:34:39",9054,{"id":44,"title":45,"uri":46,"author":8,"created_at":47,"view_count":48},49,"用latex排版中文书籍","\u002Farticle\u002F用latex排版中文书籍","2016-10-31 11:12:02",8645,{"id":50,"title":51,"uri":52,"author":8,"created_at":53,"view_count":54},19,"texlive中文书签乱码","\u002Farticle\u002Ftexlive中文书签乱码","2014-11-15 02:54:01",8466,{"id":56,"title":57,"uri":58,"author":8,"created_at":59,"view_count":60},6,"Windows上的软件包管理器chocolatey","\u002Farticle\u002FWindows上的软件包管理器chocolatey","2014-08-10 15:55:22",8012,{"id":62,"title":63,"uri":64,"author":8,"created_at":65,"view_count":66},3,"利用开源和免费资源搭建CI环境","\u002Farticle\u002F利用开源和免费资源搭建CI环境","2014-07-04 16:54:58",7740,{"id":68,"title":69,"uri":70,"author":8,"created_at":71,"view_count":72},16,"php-fpm网站目录权限配置","\u002Farticle\u002Fphp-fpm网站目录权限配置","2014-10-18 01:36:10",7276,{"id":74,"title":75,"uri":76,"author":8,"created_at":77,"view_count":78},27,"sublime text 2插件开发，外部修改文件无法重新加载","\u002Farticle\u002Fsublime text 2插件开发，外部修改文件无法重新加载","2014-12-26 20:24:13",7055,{"title":80,"list":81},"按月归档",[82,86,89,92,95,98,101,105,109,112,115,118,122,125,128,132,135,138,141,145,148,151,154,157,160,163,166,169,172,175,178,181,184,187,190,193,196,199,202,205,209,212,215,218,221,224],{"title":83,"uri":84,"view_count":85},"2026年7月","\u002Farchive\u002F2026\u002F7\u002F1","[1]",{"title":87,"uri":88,"view_count":85},"2026年1月","\u002Farchive\u002F2026\u002F1\u002F1",{"title":90,"uri":91,"view_count":85},"2025年4月","\u002Farchive\u002F2025\u002F4\u002F1",{"title":93,"uri":94,"view_count":85},"2024年6月","\u002Farchive\u002F2024\u002F6\u002F1",{"title":96,"uri":97,"view_count":85},"2024年5月","\u002Farchive\u002F2024\u002F5\u002F1",{"title":99,"uri":100,"view_count":85},"2024年4月","\u002Farchive\u002F2024\u002F4\u002F1",{"title":102,"uri":103,"view_count":104},"2023年12月","\u002Farchive\u002F2023\u002F12\u002F1","[6]",{"title":106,"uri":107,"view_count":108},"2023年11月","\u002Farchive\u002F2023\u002F11\u002F1","[2]",{"title":110,"uri":111,"view_count":85},"2023年10月","\u002Farchive\u002F2023\u002F10\u002F1",{"title":113,"uri":114,"view_count":85},"2023年7月","\u002Farchive\u002F2023\u002F7\u002F1",{"title":116,"uri":117,"view_count":108},"2023年6月","\u002Farchive\u002F2023\u002F6\u002F1",{"title":119,"uri":120,"view_count":121},"2023年5月","\u002Farchive\u002F2023\u002F5\u002F1","[3]",{"title":123,"uri":124,"view_count":108},"2023年4月","\u002Farchive\u002F2023\u002F4\u002F1",{"title":126,"uri":127,"view_count":108},"2023年3月","\u002Farchive\u002F2023\u002F3\u002F1",{"title":129,"uri":130,"view_count":131},"2023年2月","\u002Farchive\u002F2023\u002F2\u002F1","[5]",{"title":133,"uri":134,"view_count":85},"2023年1月","\u002Farchive\u002F2023\u002F1\u002F1",{"title":136,"uri":137,"view_count":108},"2022年12月","\u002Farchive\u002F2022\u002F12\u002F1",{"title":139,"uri":140,"view_count":131},"2022年11月","\u002Farchive\u002F2022\u002F11\u002F1",{"title":142,"uri":143,"view_count":144},"2022年10月","\u002Farchive\u002F2022\u002F10\u002F1","[4]",{"title":146,"uri":147,"view_count":104},"2022年9月","\u002Farchive\u002F2022\u002F9\u002F1",{"title":149,"uri":150,"view_count":131},"2022年8月","\u002Farchive\u002F2022\u002F8\u002F1",{"title":152,"uri":153,"view_count":85},"2019年7月","\u002Farchive\u002F2019\u002F7\u002F1",{"title":155,"uri":156,"view_count":85},"2019年2月","\u002Farchive\u002F2019\u002F2\u002F1",{"title":158,"uri":159,"view_count":85},"2018年9月","\u002Farchive\u002F2018\u002F9\u002F1",{"title":161,"uri":162,"view_count":85},"2018年8月","\u002Farchive\u002F2018\u002F8\u002F1",{"title":164,"uri":165,"view_count":85},"2017年11月","\u002Farchive\u002F2017\u002F11\u002F1",{"title":167,"uri":168,"view_count":85},"2017年8月","\u002Farchive\u002F2017\u002F8\u002F1",{"title":170,"uri":171,"view_count":85},"2017年5月","\u002Farchive\u002F2017\u002F5\u002F1",{"title":173,"uri":174,"view_count":85},"2017年4月","\u002Farchive\u002F2017\u002F4\u002F1",{"title":176,"uri":177,"view_count":85},"2016年11月","\u002Farchive\u002F2016\u002F11\u002F1",{"title":179,"uri":180,"view_count":85},"2016年10月","\u002Farchive\u002F2016\u002F10\u002F1",{"title":182,"uri":183,"view_count":108},"2016年9月","\u002Farchive\u002F2016\u002F9\u002F1",{"title":185,"uri":186,"view_count":85},"2016年8月","\u002Farchive\u002F2016\u002F8\u002F1",{"title":188,"uri":189,"view_count":108},"2016年7月","\u002Farchive\u002F2016\u002F7\u002F1",{"title":191,"uri":192,"view_count":131},"2016年6月","\u002Farchive\u002F2016\u002F6\u002F1",{"title":194,"uri":195,"view_count":85},"2015年12月","\u002Farchive\u002F2015\u002F12\u002F1",{"title":197,"uri":198,"view_count":85},"2015年10月","\u002Farchive\u002F2015\u002F10\u002F1",{"title":200,"uri":201,"view_count":108},"2015年2月","\u002Farchive\u002F2015\u002F2\u002F1",{"title":203,"uri":204,"view_count":85},"2015年1月","\u002Farchive\u002F2015\u002F1\u002F1",{"title":206,"uri":207,"view_count":208},"2014年12月","\u002Farchive\u002F2014\u002F12\u002F1","[8]",{"title":210,"uri":211,"view_count":108},"2014年11月","\u002Farchive\u002F2014\u002F11\u002F1",{"title":213,"uri":214,"view_count":131},"2014年10月","\u002Farchive\u002F2014\u002F10\u002F1",{"title":216,"uri":217,"view_count":121},"2014年9月","\u002Farchive\u002F2014\u002F9\u002F1",{"title":219,"uri":220,"view_count":121},"2014年8月","\u002Farchive\u002F2014\u002F8\u002F1",{"title":222,"uri":223,"view_count":121},"2014年7月","\u002Farchive\u002F2014\u002F7\u002F1",{"title":225,"uri":226,"view_count":108},"2013年9月","\u002Farchive\u002F2013\u002F9\u002F1",{"url":228,"title":229},"https:\u002F\u002Fimage.duguying.net\u002F2022\u002F09\u002Fij6x8o4s.webp","老家 摄于2020年秋",1790781595737]