正则表达式 – 这组正则表达式是否完全防止跨站点脚本?
下面的代码不会捕获什么危险的例子?
编辑:在一些评论后,我添加了另一行,评论如下.请参阅Vinko在David Grant的回答中的评论.到目前为止,只有Vinko回答了这个问题,该问题要求具体的例子可以通过这个功能. Vinko提供了一个,但我编辑了代码来关闭那个洞.如果你们中的另一个人能够想到另一个具体的例子,那么你们将得到我的投票! public static string strip_dangerous_tags(string text_with_tags) { string s = Regex.Replace(text_with_tags,@"<script","<scrSAFEipt",RegexOptions.IgnoreCase); s = Regex.Replace(s,@"</script","</scrSAFEipt",@"<object","</objSAFEct",@"</object","</obSAFEct",RegexOptions.IgnoreCase); // ADDED AFTER THIS QUESTION WAS POSTED s = Regex.Replace(s,@"javascript","javaSAFEscript",RegexOptions.IgnoreCase); s = Regex.Replace(s,@"onabort","onSAFEabort",@"onblur","onSAFEblur",@"onchange","onSAFEchange",@"onclick","onSAFEclick",@"ondblclick","onSAFEdblclick",@"onerror","onSAFEerror",@"onfocus","onSAFEfocus",@"onkeydown","onSAFEkeydown",@"onkeypress","onSAFEkeypress",@"onkeyup","onSAFEkeyup",@"onload","onSAFEload",@"onmousedown","onSAFEmousedown",@"onmousemove","onSAFEmousemove",@"onmouSEOut","onSAFEmouSEOut",@"onmouseup","onSAFEmouseup",@"onreset","onSAFEresetK",@"onresize","onSAFEresize",@"onselect","onSAFEselect",@"onsubmit","onSAFEsubmit",@"onunload","onSAFEunload",RegexOptions.IgnoreCase); return s; }
它永远不够 – 白名单,不要黑名单
例如javascript:伪URL可以使用HTML实体进行模糊处理,您已经忘记了< embed>并且在IE中存在危险的CSS属性,如行为和表达. 有7000个逃避过滤器,这种方法必将失败.即使您今天发现并阻止了所有可能的漏洞利用,未来也可能会添加新的不安全元素和属性. 保护HTML只有两种好方法: >通过替换每个<将其转换为文本与& lt;. 还要确保您的页面声明其编码,因为有利用浏览器自动检测错误编码的漏洞. (编辑:李大同) 【声明】本站内容均来自网络,其相关言论仅代表作者个人观点,不代表本站立场。若无意侵犯到您的权利,请及时与联系站长删除相关内容! |