<html class="no-js" lang="en">

<head>

<meta charset="utf-8" />

<meta name="viewport" content="width=device-width, initial-scale=1.0" />

<title>

xss基础 - lonelyorのblog

</title>

<link href="atom.xml" rel="alternate" title="lonelyorのblog" type="application/atom+xml">

<link rel="stylesheet" href="asset/css/foundation.min.css" />

<link rel="stylesheet" href="asset/css/docs.css" />

<script src="asset/js/vendor/modernizr.js"></script>

<script src="asset/js/vendor/jquery.js"></script>

<script src="asset/highlightjs/highlight.pack.js"></script>

<link href="asset/highlightjs/styles/github.css" media="screen, projection" rel="stylesheet" type="text/css">

<script>hljs.initHighlightingOnLoad();</script>

<script type="text/javascript">

function before_search(){

var searchVal = 'site:www.lonelyor.org/lonelyorNotes ' + document.getElementById('search_input').value;

document.getElementById('search_q').value = searchVal;

return true;

}

</head>

<body class="antialiased hide-extras">

<div class="marketing off-canvas-wrap" data-offcanvas>

<div class="inner-wrap">

<nav class="top-bar docs-bar hide-for-small" data-topbar>

<section class="top-bar-section">

<div class="row">

<div style="position: relative;width:100%;"><div style="position: absolute; width:100%;">

<ul id="main-menu" class="left">

<li id=""><a target="_self" href="index.html">主页</a></li>

<li id=""><a target="_self" href="archives.html">归档</a></li>

<li id=""><a target="_self" href="lost.html">失乐园</a></li>

<li id=""><a target="_self" href="about.html">关于</a></li>

</ul>

<ul class="right" id="search-wrap">

<li>

<form target="_blank" onsubmit="return before_search();" action="https://google.com/search" method="get">

<input type="hidden" id="search_q" name="q" value="" />

<input tabindex="1" type="search" id="search_input" placeholder="Search"/>

</ul>

</div></div>

</div>

</section>

<nav class="tab-bar show-for-small">

<a href="javascript:void(0)" class="left-off-canvas-toggle menu-icon">

<span> &nbsp; lonelyorのblog</span>

</a>

<aside class="left-off-canvas-menu">

<ul class="off-canvas-list">

<li><a target="_self" href="index.html">主页</a></li>

<li><a target="_self" href="archives.html">归档</a></li>

<li><a target="_self" href="lost.html">失乐园</a></li>

<li><a target="_self" href="about.html">关于</a></li>

<li><label>Categories</label></li>

<li><a href="Web%E6%94%BB%E9%98%B2.html">Web攻防</a></li>

<li><a href="%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F.html">操作系统</a></li>

<li><a href="%E8%99%9A%E6%8B%9F%E5%AE%9E%E9%AA%8C%E5%AE%A4.html">虚拟实验室</a></li>

<li><a href="CTF.html">CTF</a></li>

<li><a href="%E5%BC%80%E5%8F%91.html">开发</a></li>

<li><a href="%E6%B5%8F%E8%A7%88%E5%99%A8.html">浏览器</a></li>

<li><a href="%E5%A5%87%E6%B7%AB%E5%B7%A7%E6%8A%80.html">奇淫巧技</a></li>

</ul>

</aside>

<a class="exit-off-canvas" href="#"></a>

<section id="main-content" role="main" class="scroll-container">

<script type="text/javascript">

$(function(){

$('#menu_item_index').addClass('is_active');

});

<div class="row">

<div class="large-8 medium-8 columns">

<div class="markdown-body article-wrap">

<div class="article">

<h1>xss基础</h1>

<div class="read-more clearfix">

<span class="date">2018/12/13 16:17 下午</span>

<span>posted in&nbsp;</span>

<span class="posted-in"><a href='xss%E8%B7%A8%E7%AB%99%E8%84%9A%E6%9C%AC.html'>xss跨站脚本</a></span>

<span class="comments">

</span>

</div>

</div><!-- article -->

<div class="article-content">

<blockquote>

<p>description: 这里包含了xss的基本定义，原理、及防御方案代码示例。</p>

<h2 id="toc_0">简介</h2>

<p>跨站脚本XSS是一种注入类型攻击，攻击者注入恶意代码到web应用程序并发送给不同的最终用户时，就会发生xss攻击，并且可能发生在web应用程序<u>在其生成的输出中使用来之用户的输入</u>并且无需验证或编码它的任何地方。</p>

<p>跨站脚本发生在：</p>

<li>任何可以插入数据，并且数据包会未经恶意内容验证就发送给Web用户的地方。</li>

<p>跨站脚本分为两类：</p>

<li>反射型(又称非持久性xss): 反射性xss通常出现在错误消息、搜索结果、或者服务器实时响应部分或全部请求的地方。可以通过电子邮件、恶意链接、等途径进行攻击。</li>

<li>存储型(又称持久性xss): 存储型xss通常将恶意代码永久存储在目标服务器上，如数据库、消息论坛、访问日志、注释字段等。</li>

<li>DOM型: dom型xss我觉得也属于存储型，只不过是存储在客户端。有效载荷修改了客户端浏览器中的DOM环境并执行恶意代码，也就是说HTTP响应是不变的，恶意代码被存储在客户端响应页面中。因此很难在服务器端做安全检测。</li>

<h2 id="toc_1">危害</h2>

<p>xss可以窃取用户的会话cookie，允许攻击者劫持用户的会话并接管账号，其他攻击包括最终用户文件的泄露、木马程序安装、将用户重定向到其他页面或站点、修改内容的呈现等。</p>

<p>具体危害如：允许攻击者修改新闻稿或新闻项目的XSS漏洞可能会影响公司的股价或降低消费者信心。制药网站上的XSS漏洞可能允许攻击者修改剂量信息，从而导致过量服用。</p>

<h2 id="toc_2">防御</h2>

<p>1、在<strong>输出时</strong>将不可信数据（用户可控的数据：包括主体、属性、JavaScript、CSS或URL）使用 htmlEscape（）进行转义；将html、js中涉及到的关键字符进行html编码处理后再输出到页面上。</p>

<p>2、如果存在用户需要编写文章等功能的时候，类似用户可以自定义页面样式的功能，则需要限制用户的输入，采用严格的<strong>白名单</strong>机制来过滤用户的输入，即非用户允许的功能标签都应该被完全过滤，这种过滤应依赖于后端应用来实现。</p>

<p>3、应注意很多开源的第三方富文本编辑器，部分编辑器仅在JS端进行过滤，而不在后端进行关键字过滤。</p>

<h3 id="toc_3">代码示例</h3>

<p>1.Java<br/>

<strong>Portal 或 Spring 框架修复方案：</strong></p>

<pre class="line-numbers"><code class="language-java">import org.springframework.web.util.HtmlUtils;

target = HtmlUtils.htmlEscape(target);

<p>// target 参数为需要进行转义的参数，建议在该参数输出前进行转义</p>

<p><strong>通用型修复方案</strong>：</p>

<pre class="line-numbers"><code class="language-java">StringEscapeUtils from Apache Commons Lang:

import static org.apache.commons.lang.StringEscapeUtils.escapeHtml;

// ...

String source = &quot;The less than sign (&lt;) and ampersand (&amp;) must be escaped before using them in HTML&quot;;

String escaped = escapeHtml(source);

For version 3:

import static org.apache.commons.lang3.StringEscapeUtils.escapeHtml4;

// ...

String escaped = escapeHtml4(source);

<p>2.<strong>PHP</strong><br/>

htmlspecialchars() 在输出时使用该函数转义用户输入的值，尤其注意第二个 flag 参数要使用 ENT_QUOTES</p>

<pre class="line-numbers"><code class="language-php">&lt;?php

$name = $_GET[&quot;name&quot;];

$name = htmlspecialchars($name, ENT_QUOTES);

?&gt;

<p>htmlentities() 在输出时使用该函数转义用户输入的值</p>

<p>针对富文本，使用以下过滤类进行处理：</p>

<pre class="line-numbers"><code class="language-php">&lt;?php

/**

* PHP 富文本XSS过滤类

*

* @package XssHtml

* @version 1.0.0

* @link http://phith0n.github.io/XssHtml

* @since 20140621

* @copyright (c) Phithon All Rights Reserved

*

*/

#

# Usage:

# &lt;?php

# require(&#39;Xss.php&#39;);

# $html = &#39;&lt;html code&gt;&#39;;

# $xss = new XssHtml($html);

# $html = $xss-&gt;getHtml();

# ?\&gt;

#

# 需求：

# PHP Version &gt; 5.0

# 浏览器版本：IE7+ 或其他浏览器，无法防御IE6及以下版本浏览器中的XSS

# 更多使用选项见 http://phith0n.github.io/XssHtml

class Xss {

private $m_dom;

private $m_xss;

private $m_ok;

private $m_AllowAttr = array(&#39;title&#39;, &#39;src&#39;, &#39;href&#39;, &#39;id&#39;, &#39;class&#39;, &#39;style&#39;, &#39;width&#39;, &#39;height&#39;, &#39;alt&#39;, &#39;target&#39;, &#39;align&#39;);

private $m_AllowTag = array(&#39;img&#39;, &#39;br&#39;, &#39;strong&#39;, &#39;b&#39;, &#39;code&#39;, &#39;p&#39;, &#39;div&#39;, &#39;em&#39;, &#39;span&#39;, &#39;h1&#39;, &#39;h2&#39;, &#39;h3&#39;, &#39;h4&#39;, &#39;h5&#39;, &#39;h6&#39;, &#39;table&#39;, &#39;ul&#39;, &#39;ol&#39;, &#39;tr&#39;, &#39;th&#39;, &#39;td&#39;, &#39;hr&#39;, &#39;li&#39;, &#39;u&#39;);

/**

* 构造函数

*

* @param string $html 待过滤的文本

* @param string $charset 文本编码，默认utf-8

* @param array $AllowTag 允许的标签，如果不清楚请保持默认，默认已涵盖大部分功能，不要增加危险标签

*/

public function __construct($html, $charset = &#39;utf-8&#39;, $AllowTag = array()){

$this-&gt;m_AllowTag = empty($AllowTag) ? $this-&gt;m_AllowTag : $AllowTag;

$this-&gt;m_xss = strip_tags($html, &#39;&lt;&#39; . implode(&#39;&gt;&lt;&#39;, $this-&gt;m_AllowTag) . &#39;&gt;&#39;);

if (empty($this-&gt;m_xss)) {

$this-&gt;m_ok = FALSE;

return ;

}

$this-&gt;m_xss = &quot;&lt;meta http-equiv=\&quot;Content-Type\&quot; content=\&quot;text/html;charset={$charset}\&quot;&gt;&lt;nouse&gt;&quot; . $this-&gt;m_xss . &quot;&lt;/nouse&gt;&quot;;

$this-&gt;m_dom = new DOMDocument();

$this-&gt;m_dom-&gt;strictErrorChecking = FALSE;

$this-&gt;m_ok = @$this-&gt;m_dom-&gt;loadHTML($this-&gt;m_xss);

}

/**

* 获得过滤后的内容

*/

public function getHtml()

{

if (!$this-&gt;m_ok) {

return &#39;&#39;;

}

$nodeList = $this-&gt;m_dom-&gt;getElementsByTagName(&#39;*&#39;);

for ($i = 0; $i &lt; $nodeList-&gt;length; $i++){

$node = $nodeList-&gt;item($i);

if (in_array($node-&gt;nodeName, $this-&gt;m_AllowTag)) {

if (method_exists($this, &quot;__node_{$node-&gt;nodeName}&quot;)) {

call_user_func(array($this, &quot;__node_{$node-&gt;nodeName}&quot;), $node);

}else{

call_user_func(array($this, &#39;__node_default&#39;), $node);

}

}

}

$html = strip_tags($this-&gt;m_dom-&gt;saveHTML(), &#39;&lt;&#39; . implode(&#39;&gt;&lt;&#39;, $this-&gt;m_AllowTag) . &#39;&gt;&#39;);

$html = preg_replace(&#39;/^\n(.*)\n$/s&#39;, &#39;$1&#39;, $html);

return $html;

}

private function __true_url($url){

if (preg_match(&#39;#^https?://.+#is&#39;, $url)) {

return $url;

}else{

return &#39;http://&#39; . $url;

}

}

private function __get_style($node){

if ($node-&gt;attributes-&gt;getNamedItem(&#39;style&#39;)) {

$style = $node-&gt;attributes-&gt;getNamedItem(&#39;style&#39;)-&gt;nodeValue;

$style = str_replace(&#39;\\&#39;, &#39; &#39;, $style);

$style = str_replace(array(&#39;&amp;#&#39;, &#39;/*&#39;, &#39;*/&#39;), &#39; &#39;, $style);

$style = preg_replace(&#39;#e.*x.*p.*r.*e.*s.*s.*i.*o.*n#Uis&#39;, &#39; &#39;, $style);

return $style;

}else{

return &#39;&#39;;

}

}

private function __get_link($node, $att){

$link = $node-&gt;attributes-&gt;getNamedItem($att);

if ($link) {

return $this-&gt;__true_url($link-&gt;nodeValue);

}else{

return &#39;&#39;;

}

}

private function __setAttr($dom, $attr, $val){

if (!empty($val)) {

$dom-&gt;setAttribute($attr, $val);

}

}

private function __set_default_attr($node, $attr, $default = &#39;&#39;)

{

$o = $node-&gt;attributes-&gt;getNamedItem($attr);

if ($o) {

$this-&gt;__setAttr($node, $attr, $o-&gt;nodeValue);

}else{

$this-&gt;__setAttr($node, $attr, $default);

}

}

private function __common_attr($node)

{

$list = array();

foreach ($node-&gt;attributes as $attr) {

if (!in_array($attr-&gt;nodeName,

$this-&gt;m_AllowAttr)) {

$list[] = $attr-&gt;nodeName;

}

}

foreach ($list as $attr) {

$node-&gt;removeAttribute($attr);

}

$style = $this-&gt;__get_style($node);

$this-&gt;__setAttr($node, &#39;style&#39;, $style);

$this-&gt;__set_default_attr($node, &#39;title&#39;);

$this-&gt;__set_default_attr($node, &#39;id&#39;);

$this-&gt;__set_default_attr($node, &#39;class&#39;);

}

private function __node_img($node){

$this-&gt;__common_attr($node);

$this-&gt;__set_default_attr($node, &#39;src&#39;);

$this-&gt;__set_default_attr($node, &#39;width&#39;);

$this-&gt;__set_default_attr($node, &#39;height&#39;);

$this-&gt;__set_default_attr($node, &#39;alt&#39;);

$this-&gt;__set_default_attr($node, &#39;align&#39;);

}

private function __node_a($node){

$this-&gt;__common_attr($node);

$href = $this-&gt;__get_link($node, &#39;href&#39;);

$this-&gt;__setAttr($node, &#39;href&#39;, $href);

$this-&gt;__set_default_attr($node, &#39;target&#39;, &#39;_blank&#39;);

}

private function __node_embed($node){

$this-&gt;__common_attr($node);

$link = $this-&gt;__get_link($node, &#39;src&#39;);

$this-&gt;__setAttr($node, &#39;src&#39;, $link);

$this-&gt;__setAttr($node, &#39;allowscriptaccess&#39;, &#39;never&#39;);

$this-&gt;__set_default_attr($node, &#39;width&#39;);

$this-&gt;__set_default_attr($node, &#39;height&#39;);

}

private function __node_default($node){

$this-&gt;__common_attr($node);

}

}

?&gt;

</div>

<div class="row">

<div class="large-6 columns">

<p class="text-left" style="padding:15px 0px;">

<a href="15446891028198.html"

title="Previous Post: xss测试备忘录">&laquo; xss测试备忘录</a>

</p>

</div>

<div class="large-6 columns">

<p class="text-right" style="padding:15px 0px;">

<a href="15446888524769.html"

title="Next Post: xss检测">xss检测 &raquo;</a>

</p>

</div>

</div>

<div class="comments-wrap">

<div class="share-comments">

</div>

</div>

</div><!-- article-wrap -->

</div><!-- large 8 -->

<link rel="bookmark" href="http://images.lonelyor.org/favicon.ico" />

<link rel="shortcut icon" href="http://images.lonelyor.org/favicon.ico" />

<script id="dsq-count-scr" src="//lonelyor.disqus.com/count.js" async></script>

<div class="large-4 medium-4 columns">

<div class="hide-for-small">

<div id="sidebar" class="sidebar">

<div id="site-info" class="site-info">

<div class="site-a-logo"><img src="http://images.lonelyor.org/lonelyornotesico.jpeg" /></div>

</br>

<h1>lonelyorのblog</h1>

<div class="site-des">一个用来记录学习笔记的网站</div>

<div class="social">

<a target="_blank" class="github" target="_blank" href="https://github.com/AlShelley/lonelyorNotes" title="GitHub">GitHub</a>

<a target="_blank" class="email" href="mailto:lonelyor.org@gmail.com" title="Email">Email</a>

<a target="_blank" class="rss" href="atom.xml" title="RSS">RSS</a>

</div>

</div>

<div id="site-categories" class="side-item ">

<div class="side-header">

<h2>分类</h2>

</div>

<div class="side-content">

<p class="cat-list">

<a href="Web%E6%94%BB%E9%98%B2.html"><strong>Web攻防</strong></a>

<a href="%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F.html"><strong>操作系统</strong></a>

<a href="%E8%99%9A%E6%8B%9F%E5%AE%9E%E9%AA%8C%E5%AE%A4.html"><strong>虚拟实验室</strong></a>

<a href="CTF.html"><strong>CTF</strong></a>

<a href="%E5%BC%80%E5%8F%91.html"><strong>开发</strong></a>

<a href="%E6%B5%8F%E8%A7%88%E5%99%A8.html"><strong>浏览器</strong></a>

<a href="%E5%A5%87%E6%B7%AB%E5%B7%A7%E6%8A%80.html"><strong>奇淫巧技</strong></a>

</p>

</div>

</div>

<div id="site-categories" class="side-item">

<div class="side-header">

<h2>最新文章</h2>

</div>

<div class="side-content">

<ul class="posts-list">

<li class="post">

<a href="15453720146052.html">Pycharm编程遇到的技巧</a>

</li>

<li class="post">

<a href="15453717965995.html">npm Cannot find module 'semver' --解决方案</a>

</li>

<li class="post">

<a href="15453716917526.html">mongodb安装配置（arch）</a>

</li>

<li class="post">

<a href="15453714645346.html">linux安装配置aria2及其Web图形界面（debian为例）</a>

</li>

<li class="post">

<a href="15453713553710.html">linux下搜狗输入法不能用的解决办法</a>

</li>

</ul>

</div>

</div>

</div><!-- sidebar -->

</div><!-- hide for small -->

<div class="page-bottom clearfix">

<div class="row">

<p class="copyright">Copyright &copy; 2018

Powered by <a target="_blank" href="http://www.mweb.im">MWeb</a>,&nbsp;

Theme used <a target="_blank" href="http://github.com">GitHub CSS</a>,&nbsp;

Author is <a target="_blank" href="http://lonelyor.org">lonelyor</a>

</div>

</section>

</div>

</div>

<script src="asset/js/foundation.min.js"></script>

<script>

$(document).foundation();

function fixSidebarHeight(){

var w1 = $('.markdown-body').height();

var w2 = $('#sidebar').height();

if (w1 > w2) { $('#sidebar').height(w1); };

}

$(function(){

fixSidebarHeight();

})

$(window).load(function(){

fixSidebarHeight();

});

</script>

<div class="bdsharebuttonbox"><a href="#" class="bds_more" data-cmd="more">分享到：</a><a href="#" class="bds_qzone" data-cmd="qzone" title="分享到QQ空间">QQ空间</a><a href="#" class="bds_weixin" data-cmd="weixin" title="分享到微信">微信</a><a href="#" class="bds_tsina" data-cmd="tsina" title="分享到新浪微博">新浪微博</a><a href="#" class="bds_tqq" data-cmd="tqq" title="分享到腾讯微博">腾讯微博</a><a href="#" class="bds_fbook" data-cmd="fbook" title="分享到Facebook">Facebook</a></div>

<script>window._bd_share_config={"common":{"bdSnsKey":{},"bdText":"来自：http://www.lonelyor.org/","bdMini":"1","bdMiniList":["sqq","weixin","fbook","twi","qzone","tsina","tqq","tieba","douban","tsohu","linkedin","mshare","copy"],"bdPic":"http://images.lonelyor.org/lonelyornotesico.jpeg","bdStyle":"1","bdSize":"16"},"share":{"bdSize":16},"image":{"viewList":["qzone","weixin","tsina","tqq","fbook"],"viewText":"分享到：","viewSize":"24"},"selectShare":{"bdContainerClass":null,"bdSelectMiniList":["qzone","weixin","tsina","tqq","fbook"]}};with(document)0[(getElementsByTagName('head')[0]||body).appendChild(createElement('script')).src='http://bdimg.share.baidu.com/static/api/js/share.js?v=89860593.js?cdnversion='+~(-new Date()/36e5)];</script>

</body>