论文部分内容阅读
随着Web服务的应用日益广泛,Web应用程序的安全受到越来越多的重视,跨站脚本是其中最常见的一种安全隐患。本文首先简要阐述了跨站脚本漏洞的成因及特点,然后结合不可信数据在Web应用程序中的处理流程,总结出Web应用程序在处理不可信数据的不同阶段采取的常见过滤机制,最后以现有的攻击向量实例为基础,从编码方式、JavaScript伪协议、事件处理函数、混淆字符、特定JavaScript函数和层叠样式表等方面归纳并分析了跨站脚本的过滤逃逸技术及其应用。
With the increasing use of Web services, Web application security is receiving more and more attention. Cross-site scripting is one of the most common security risks. This paper first briefly describes the causes and characteristics of cross-site scripting vulnerabilities, then combines the processing flow of untrusted data in Web applications, summarizes the common filtering mechanism adopted by Web applications in different stages of handling untrusted data, Based on some examples of attack vectors, this paper summarizes and analyzes cross-site scripting filtering and escaping from the aspects of encoding, JavaScript pseudo-protocol, event handling functions, confusing characters, specific JavaScript functions and cascading style sheets.