javascript過濾危險腳本方法_javascript技巧

來源：懂視網責編：小采時間：2020-11-27 20:39:40

javascript過濾危險腳本方法_javascript技巧

javascript過濾危險腳本方法_javascript技巧:腳本藏身之處不過有四： 1、<script>標簽、<link>標簽、<style>標簽、iframe標簽 2、on開頭的標簽屬性 3、javascript(vbscript)偽協議 4、css的epression下面是他們的字符串規則： 1、<(script|link|style

推薦度：

點擊下載本文 文檔為doc格式

導讀javascript過濾危險腳本方法_javascript技巧:腳本藏身之處不過有四： 1、<script>標簽、<link>標簽、<style>標簽、iframe標簽 2、on開頭的標簽屬性 3、javascript(vbscript)偽協議 4、css的epression下面是他們的字符串規則： 1、<(script|link|style

腳本藏身之處不過有四： 1、<script>標簽、<link>標簽、<style>標簽、iframe標簽 2、on開頭的標簽屬性 3、javascript(vbscript)偽協議 4、css的epression

<textarea id="bug" cols="80" rows="16"> 
<button id="kick">抓蟲1</button> 
<script> 
function kickBug(str) { 
return str.replace(/<(script|link|style|iframe)(.|\n)*\/\1>\s*/ig,""); 
} 
</script> 
<iframe></iframe> 
<link href='test.css'></link> 
<style> 
a { 
height:expression(alert('hei')); 
} 
</style> 
</textarea> 
<button id="kick">抓蟲1</button> 
<script> 
function kickBug(str) { 
return str.replace(/<(script|link|style|iframe)(.|\n)*\/\1>\s*/ig,""); 
} 
if(!/msie/i.test(navigator.userAgent)){ 
HTMLElement.prototype.__defineGetter__("innerText",function(){ 
return this.textContent; 
}); 
HTMLElement.prototype.__defineSetter__("innerText",function(text){ 
this.textContent = text; 
}); 
} 
document.getElementById("kick").onclick = function() { 
var bug = document.getElementById("bug"); 
bug.innerText = kickBug(bug.innerText); 
} 
</script>

<textarea id="bug" cols="80" rows="5"> 
<a onclick="test(); 
test1()" onblur= 
"test3()">test</a> 
</textarea> 
<button id="kick">抓蟲2</button> 
<script> 
function kickBug(str) { 
return str.replace(/<[a-z][^>]*\s*on[a-z]+\s*=[^>]+/ig,function($0,$1){ 
return $0.replace(/\s*on[a-z]+\s*=\s*("[^"]+"|'[^']+'|[^\s]+)\s*/ig,""); 
}); 
} 
if(!/msie/i.test(navigator.userAgent)){ 
HTMLElement.prototype.__defineGetter__("innerText",function(){ 
return this.textContent; 
}); 
HTMLElement.prototype.__defineSetter__("innerText",function(text){ 
this.textContent = text; 
}); 
} 
document.getElementById("kick").onclick = function() { 
var bug = document.getElementById("bug"); 
bug.innerText = kickBug(bug.innerText); 
} 
</script>

<textarea id="bug" cols="80" rows="5"> 
<a onclick="test();" href=" 
jAvascript:alert('a')" href="jAvascript:" 
href="vbscript:alert()" 
>test</a> 
</textarea> 
<button id="kick">抓蟲3</button> 
<script> 
function kickBug(str) { 
return str.replace(/<[a-z][^>]*\s*(href|src)\s*=[^>]+/ig,function($0,$1){ 
$0 = $0.replace(/&#(6[5-9]|[78][0-9]|9[0789]|1[01][0-9]|12[012]);?/g,function($0,$1){return String.fromCharCode($1);}); 
return $0.replace(/\s*(href|src)\s*=\s*("\s*(javascript|vbscript):[^"]+"|'\s*(javascript|vbscript):[^']+'|(javascript|vbscript):[^\s]+)/ig,""); 
}); 
} 
if(!/msie/i.test(navigator.userAgent)){ 
HTMLElement.prototype.__defineGetter__("innerText",function(){ 
return this.textContent; 
}); 
HTMLElement.prototype.__defineSetter__("innerText",function(text){ 
this.textContent = text; 
}); 
} 
document.getElementById("kick").onclick = function() { 
var bug = document.getElementById("bug"); 
bug.innerText = kickBug(bug.innerText); 
} 
</script>

<textarea id="bug" cols="80" rows="5"> 
expression() 
<a style="color:expression( 
'red' 
)">test</a> 
</textarea> 
<button id="kick">抓蟲4</button> 
<script> 
function kickBug(str) { 
return str.replace(/<[a-z][^>]*\s*style\s*=[^>]+/ig,function($0,$1){ 
$0 = $0.replace(/&#(6[5-9]|[78][0-9]|9[0789]|1[01][0-9]|12[012]);?/g,function($0,$1){return String.fromCharCode($1);}); 
return $0.replace(/\s*style\s*=\s*("[^"]+(expression)[^"]+"|'[^']+\2[^']+'|[^\s]+\2[^\s]+)\s*/ig,""); 
}); 
} 
if(!/msie/i.test(navigator.userAgent)){ 
HTMLElement.prototype.__defineGetter__("innerText",function(){ 
return this.textContent; 
}); 
HTMLElement.prototype.__defineSetter__("innerText",function(text){ 
this.textContent = text; 
}); 
} 
document.getElementById("kick").onclick = function() { 
var bug = document.getElementById("bug"); 
bug.innerText = kickBug(bug.innerText); 
} 
</script>

這樣調用就可以
k1(k2(k3(k4(str))))

這樣就是單純地過濾腳本而已，所謂過濾“危險腳本”應該是能夠判斷哪些屬于“危險"腳本，不危險的就不過濾才對……那可就難辦了，相當于防火墻了。

聲明：本網頁內容旨在傳播知識，若有侵權等問題請及時與本網聯系，我們將在第一時間刪除處理。TEL:177 7030 7066 E-MAIL:11247931@qq.com