Ignoring base tag after post

折月煮酒 提交于 2019-12-23 09:52:39

问题


On Chrome I'm getting an error Refused to execute a JavaScript script. Source code of script found within request. after posting data that contains the name of the domain (also note the lack of javascript on either page) .

badpage1.html:

<form action="/badpage2.html" method="post">
<input type="hidden" name="name" value="href=%22http://www.w3.org/%22"/>
<input type="submit" name="submit"/>
</form>

badpage2.html:

<!DOCTYPE html>
<html>
    <head>
        <base href="http://www.w3.org/"/>
    </head>
    <body>
        <img src="Icons/w3c_home" alt="">
    </body>
</html>

If you go directly to badpage2.html the image will show, but if you go to it via badpage1.html, the image will not show (base tag doesn't work).

Is this a bug in Chrome XSS detection? And if it's not, how would I bypass this? It seems silly to encode the posted data just to bypass this filter.

EDIT:

In my case, the post value sent is to update part of the content of the page. The problem comes if it contains happens to contain the domain name that is used in the <base> (as this example does) it will trigger the XSS detection which disables the <base> tag.


回答1:


I found out that I can send the custom HTTP header X-XSS-Protection on the page that is being messed up due to the protection.

I use the below code for my PHP solution:

header( "X-XSS-Protection: 0" );


来源:https://stackoverflow.com/questions/9423220/ignoring-base-tag-after-post

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!