[{"data":1,"prerenderedAt":232},["ShallowReactive",2],{"tag-跨站脚本攻击-1":3},{"title":4,"articles":5,"hot_article":17,"month_arch":80,"total":228,"cover":229},"跨站脚本攻击 - 独孤影的博客",[6],{"id":7,"title":8,"uri":8,"author":9,"tags":10,"created_at":14,"view_count":15,"content":16},24,"XSS攻击应对方案","duguying",[11,12,13],"XSS","攻击","跨站脚本攻击","2014-12-14 19:39:48",6825,"\u003Cp>XSS(Cross Site Scripting)，跨站脚本攻击，简单来说就是用户获取到了页面脚本执行的权限，够获取到JS脚本执行权限后能干的事情很多，比如盗取session id，从而实现登录帐号从而获取账户相关信息。\u003Cbr\u002F>\u003C\u002Fp>\u003Cp>XSS攻击一般都是出现在有富文本提交的表单中，用户可以在提交的富文本中按以下各种方法插入JavaScript脚本：\u003C\u002Fp>\u003Cpre class=\"brush:html;toolbar:false\"><script>alert("hacked!");<\u002Fscript>\u003C\u002Fpre>\u003Cpre class=\"brush:html;toolbar:false\"><img src=".\u002F" onerror="alert('hacked!');">\u003C\u002Fpre>\u003Cpre class=\"brush:html;toolbar:false\"><a href="javascript:alert('hacked!')">foo<\u002Fa>\u003C\u002Fpre>\u003Cpre class=\"brush:html;toolbar:false\"><style>\ndiv{\n  background: url("javascript:alert('hacked!');");\n}\n<\u002Fstyle>\u003C\u002Fpre>\u003Cp>以及其他的各种方法在页面执行Js脚本，当然黑客执行脚本的目的并不是为了弹窗装逼，而是读取当前用户的cookies，从而获取session id，达到非法登录用户账户的目的，简单来说就是不要密码盗号。\u003Cbr\u002F>\u003C\u002Fp>\u003Cp>嵌入式web页面富文本编辑器很多，例如ueditor等，有人以为防范XSS攻击是这些编辑器的事情，事实上XSS攻击并不是这些编辑器能够阻止得了的，因为黑客是可以绕过编辑器提交表单的，所以防范XSS攻击的重点是后台字符串过滤，将非法的串过滤掉，当然还有另外一种办法，那就是使用第三方替代标签，如UBB标签(discuz中使用的就是这个)、Markdown等，不直接使用HTML系列的标签由其他标签转换为HTML，从而达到防止非法注入脚本的目的。\u003C\u002Fp>\u003Cp>事实上富文本提交攻击防范远不止XSS这些，XSS主要是指Js脚本的攻击，可是有一种不致命却很糟糕的攻击却是被忽略了，那就是css脚本扰乱界面布局，事实上这应该算是纯粹的捣乱，可是却也能够严重的影响到页面的美观以及用户的正常使用，开源中国就曾经被大家用这种方法玩坏过。\u003C\u002Fp>\u003Cpre class=\"brush:html;toolbar:false\"><div style="display:block;position:fixed;width:100%;height:100%;background-color:red;"><\u002Fdiv>\u003C\u002Fpre>\u003Cp>上面的代码便可以让整个网页变成红色。\u003Cbr\u002F>\u003C\u002Fp>\u003Cp>因此，我个人认为html富文本的过滤不仅仅是简单的Js过滤，应当连css一起过滤掉。或者干脆使用第三方标签UBB等。\u003C\u002Fp>",{"title":18,"list":19},"最热文章",[20,26,32,38,44,50,56,62,68,74],{"id":21,"title":22,"uri":23,"author":9,"created_at":24,"view_count":25},28,"docker容器目录与主机目录同步","\u002Farticle\u002Fdocker容器目录与主机目录同步","2014-12-31 12:34:08",15573,{"id":27,"title":28,"uri":29,"author":9,"created_at":30,"view_count":31},21,"beego中使用fis","\u002Farticle\u002Fbeego中使用fis","2014-12-03 10:47:56",9253,{"id":33,"title":34,"uri":35,"author":9,"created_at":36,"view_count":37},20,"用github登录，oauth开发","\u002Farticle\u002F用github登录，oauth开发","2014-11-23 13:33:37",9115,{"id":39,"title":40,"uri":41,"author":9,"created_at":42,"view_count":43},18,"windows服务注册工具nssm","\u002Farticle\u002Fwindows服务注册工具nssm","2014-10-31 21:34:39",9054,{"id":45,"title":46,"uri":47,"author":9,"created_at":48,"view_count":49},49,"用latex排版中文书籍","\u002Farticle\u002F用latex排版中文书籍","2016-10-31 11:12:02",8645,{"id":51,"title":52,"uri":53,"author":9,"created_at":54,"view_count":55},19,"texlive中文书签乱码","\u002Farticle\u002Ftexlive中文书签乱码","2014-11-15 02:54:01",8466,{"id":57,"title":58,"uri":59,"author":9,"created_at":60,"view_count":61},6,"Windows上的软件包管理器chocolatey","\u002Farticle\u002FWindows上的软件包管理器chocolatey","2014-08-10 15:55:22",8012,{"id":63,"title":64,"uri":65,"author":9,"created_at":66,"view_count":67},3,"利用开源和免费资源搭建CI环境","\u002Farticle\u002F利用开源和免费资源搭建CI环境","2014-07-04 16:54:58",7740,{"id":69,"title":70,"uri":71,"author":9,"created_at":72,"view_count":73},16,"php-fpm网站目录权限配置","\u002Farticle\u002Fphp-fpm网站目录权限配置","2014-10-18 01:36:10",7276,{"id":75,"title":76,"uri":77,"author":9,"created_at":78,"view_count":79},27,"sublime text 2插件开发，外部修改文件无法重新加载","\u002Farticle\u002Fsublime text 2插件开发，外部修改文件无法重新加载","2014-12-26 20:24:13",7055,{"title":81,"list":82},"按月归档",[83,87,90,93,96,99,102,106,110,113,116,119,123,126,129,133,136,139,142,146,149,152,155,158,161,164,167,170,173,176,179,182,185,188,191,194,197,200,203,206,210,213,216,219,222,225],{"title":84,"uri":85,"view_count":86},"2026年7月","\u002Farchive\u002F2026\u002F7\u002F1","[1]",{"title":88,"uri":89,"view_count":86},"2026年1月","\u002Farchive\u002F2026\u002F1\u002F1",{"title":91,"uri":92,"view_count":86},"2025年4月","\u002Farchive\u002F2025\u002F4\u002F1",{"title":94,"uri":95,"view_count":86},"2024年6月","\u002Farchive\u002F2024\u002F6\u002F1",{"title":97,"uri":98,"view_count":86},"2024年5月","\u002Farchive\u002F2024\u002F5\u002F1",{"title":100,"uri":101,"view_count":86},"2024年4月","\u002Farchive\u002F2024\u002F4\u002F1",{"title":103,"uri":104,"view_count":105},"2023年12月","\u002Farchive\u002F2023\u002F12\u002F1","[6]",{"title":107,"uri":108,"view_count":109},"2023年11月","\u002Farchive\u002F2023\u002F11\u002F1","[2]",{"title":111,"uri":112,"view_count":86},"2023年10月","\u002Farchive\u002F2023\u002F10\u002F1",{"title":114,"uri":115,"view_count":86},"2023年7月","\u002Farchive\u002F2023\u002F7\u002F1",{"title":117,"uri":118,"view_count":109},"2023年6月","\u002Farchive\u002F2023\u002F6\u002F1",{"title":120,"uri":121,"view_count":122},"2023年5月","\u002Farchive\u002F2023\u002F5\u002F1","[3]",{"title":124,"uri":125,"view_count":109},"2023年4月","\u002Farchive\u002F2023\u002F4\u002F1",{"title":127,"uri":128,"view_count":109},"2023年3月","\u002Farchive\u002F2023\u002F3\u002F1",{"title":130,"uri":131,"view_count":132},"2023年2月","\u002Farchive\u002F2023\u002F2\u002F1","[5]",{"title":134,"uri":135,"view_count":86},"2023年1月","\u002Farchive\u002F2023\u002F1\u002F1",{"title":137,"uri":138,"view_count":109},"2022年12月","\u002Farchive\u002F2022\u002F12\u002F1",{"title":140,"uri":141,"view_count":132},"2022年11月","\u002Farchive\u002F2022\u002F11\u002F1",{"title":143,"uri":144,"view_count":145},"2022年10月","\u002Farchive\u002F2022\u002F10\u002F1","[4]",{"title":147,"uri":148,"view_count":105},"2022年9月","\u002Farchive\u002F2022\u002F9\u002F1",{"title":150,"uri":151,"view_count":132},"2022年8月","\u002Farchive\u002F2022\u002F8\u002F1",{"title":153,"uri":154,"view_count":86},"2019年7月","\u002Farchive\u002F2019\u002F7\u002F1",{"title":156,"uri":157,"view_count":86},"2019年2月","\u002Farchive\u002F2019\u002F2\u002F1",{"title":159,"uri":160,"view_count":86},"2018年9月","\u002Farchive\u002F2018\u002F9\u002F1",{"title":162,"uri":163,"view_count":86},"2018年8月","\u002Farchive\u002F2018\u002F8\u002F1",{"title":165,"uri":166,"view_count":86},"2017年11月","\u002Farchive\u002F2017\u002F11\u002F1",{"title":168,"uri":169,"view_count":86},"2017年8月","\u002Farchive\u002F2017\u002F8\u002F1",{"title":171,"uri":172,"view_count":86},"2017年5月","\u002Farchive\u002F2017\u002F5\u002F1",{"title":174,"uri":175,"view_count":86},"2017年4月","\u002Farchive\u002F2017\u002F4\u002F1",{"title":177,"uri":178,"view_count":86},"2016年11月","\u002Farchive\u002F2016\u002F11\u002F1",{"title":180,"uri":181,"view_count":86},"2016年10月","\u002Farchive\u002F2016\u002F10\u002F1",{"title":183,"uri":184,"view_count":109},"2016年9月","\u002Farchive\u002F2016\u002F9\u002F1",{"title":186,"uri":187,"view_count":86},"2016年8月","\u002Farchive\u002F2016\u002F8\u002F1",{"title":189,"uri":190,"view_count":109},"2016年7月","\u002Farchive\u002F2016\u002F7\u002F1",{"title":192,"uri":193,"view_count":132},"2016年6月","\u002Farchive\u002F2016\u002F6\u002F1",{"title":195,"uri":196,"view_count":86},"2015年12月","\u002Farchive\u002F2015\u002F12\u002F1",{"title":198,"uri":199,"view_count":86},"2015年10月","\u002Farchive\u002F2015\u002F10\u002F1",{"title":201,"uri":202,"view_count":109},"2015年2月","\u002Farchive\u002F2015\u002F2\u002F1",{"title":204,"uri":205,"view_count":86},"2015年1月","\u002Farchive\u002F2015\u002F1\u002F1",{"title":207,"uri":208,"view_count":209},"2014年12月","\u002Farchive\u002F2014\u002F12\u002F1","[8]",{"title":211,"uri":212,"view_count":109},"2014年11月","\u002Farchive\u002F2014\u002F11\u002F1",{"title":214,"uri":215,"view_count":132},"2014年10月","\u002Farchive\u002F2014\u002F10\u002F1",{"title":217,"uri":218,"view_count":122},"2014年9月","\u002Farchive\u002F2014\u002F9\u002F1",{"title":220,"uri":221,"view_count":122},"2014年8月","\u002Farchive\u002F2014\u002F8\u002F1",{"title":223,"uri":224,"view_count":122},"2014年7月","\u002Farchive\u002F2014\u002F7\u002F1",{"title":226,"uri":227,"view_count":109},"2013年9月","\u002Farchive\u002F2013\u002F9\u002F1",1,{"url":230,"title":231},"https:\u002F\u002Fimage.duguying.net\u002F2022\u002F09\u002Fij6x8o4s.webp","老家 摄于2020年秋",1790781595789]