New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

存在xss漏洞 #12

Open

Silver-Glacier opened this issue Apr 15, 2023 · 0 comments

Silver-Glacier commented Apr 15, 2023

此处代码对于scheduleTitle直接进行了.val()获取值，而不是将其直接使用html进行转义，存在XSS漏洞
故可以在输入日程title的地方轻易构造xss

推荐防御：使用htmlspecialchars()函数将特殊字符转换为HTML实体

测试单位：山东大学网络空间安全学院

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment