修改跨站脚本攻击缺陷

2024-03-20 10:28:46 +08:00
parent 1e2d2b9a9b
commit df9298aac3
2 changed files with 12 additions and 4 deletions
@@ -144,9 +144,13 @@
        }

        if(url && /^\//.test(url)) {
-            var a = document.createElement('a');
-            a.href = htmlspecialchars(url);
-            a.ref= 'nofollow noopener noreferrer'
+          var a = document.createElement('a');
+          const index = url.indexOf('?')
+          const searchLeft = url.slice(0, index)
+          const searchRight = url.slice(index + 1, url.length)
+          url = searchLeft + htmlspecialchars(searchRight)
+            a.href = url;
+            a.rel= 'nofollow noopener noreferrer'
            browser.ie && (a.href = a.href);
            url = browser.ie ? a.href:(a.protocol + '//' + a.host + a.pathname + a.search + a.hash);
        }