修改跨站脚本攻击缺陷

2024-03-20 10:28:46 +08:00
parent 1e2d2b9a9b
commit df9298aac3
2 changed files with 12 additions and 4 deletions
@@ -288,7 +288,11 @@ export const ConfigurableTableMixin = {
          // this.$message.success(`${info.file.name} 文件上传成功`);
          if (info.file.response.code === 201) {
            const { message, result: { msg, fileUrl, fileName } } = info.file.response
-            const href = this.htmlspecialchars(window._CONFIG.domianURL + fileUrl)
+            let href = window._CONFIG.domianURL + fileUrl
+            const index = href.indexOf('?')
+            const searchLeft = href.slice(0, index)
+            const searchRight = href.slice(index + 1, href.length)
+            href = searchLeft + this.htmlspecialchars(searchRight)
            this.$warning({
              title: message,
              content: (