New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

存在xss漏洞 #12

Open

Silver-Glacier opened this issue Apr 15, 2023 · 0 comments

Silver-Glacier commented Apr 15, 2023

此处代码对于scheduleTitle直接进行了.val()获取值，而不是将其直接使用html进行转义，存在XSS漏洞
故可以在输入日程title的地方轻易构造xss

推荐防御：使用htmlspecialchars()函数将特殊字符转换为HTML实体

测试单位：山东大学网络空间安全学院

# for free to join this conversation on GitHub. Already have an account? # to comment