可能会窃取或操纵客户会话和 cookie,它们可能用于模仿合法用户,从而使黑客能够以该用户身份查看或变更用户记录以及执行事务
view-source:?';alert();/*
<script type="text/javascript">
(function (global) {
var newNode = global.document.createElement('script'),
existingNode = global.document.getElementsByTagName('script')[0],
adSource = '',
userId = '2025898',
browserId = 'S/AE5RYypw4',
ipAddress = '114.254.41.32',
criteria = '3:/?';alert();/*',
preview = '',
debug = false,
adSlots = ['dale_location_home_top_right'];
global.DoubanAdRequest = {src: adSource, uid: userId, bid: browserId, ip: ipAddress, crtr: criteria, prv: preview, debug: debug};
global.DoubanAdSlots = (global.DoubanAdSlots || []).concat(adSlots);
newNode.setAttribute('type', 'text/javascript');
newNode.setAttribute('src', '');
newNode.setAttribute('async', true);
existingNode.parentNode.insertBefore(newNode, existingNode);
})(this);
</script>
修复方案:
清理用户输入,涛涛电脑知识网,涛涛电脑知识网,并过滤出代码。