phpwind9.0安全监测出现xss漏洞解决方法
近期phpwind在一些安全检测中会出现一个xss的漏洞，这个漏洞缺缺的说是“富文本存储型XSS漏洞”。
漏洞描述：
XSS是一种经常出现在web应用中的计算机安全漏洞，它允许恶意web用户将代码植入到提供给其它用户使用的页面中。比如这些代码包括HTML代码和客户端脚本。攻击者利用XSS漏洞旁路掉访问控制
目前该漏洞还没有什么危害
解决办法：
/src/library/ubb/PwUbbCode.php,
最底部的escapeUrl函数替换为：
public static function escapeUrl($path) {
if(!(strpos($path, ‘http://’)===0 || strpos($path, ‘https://’)===0)) {
return ”;
}
//fixed bug ,http://www.网址.org/bugs/wooyun-2014-063613
$path = str_replace(array(“<“,”>”,”'”,”'”,”"”,”"”,”‘”,”\””,”;”,” “), array(“%3c”,”%3e”,”%27″,”%27″,”%22″,”%22″,”%27″,”%22″,”%3b”,”%20″),$path);
return $path;
}
parseFlash函数替换为：
public static function parseFlash($message, $convertStatus = 1) {
if ($convertStatus) {
return preg_replace(“/\[flash(=(\d+?)\,(\d+?)(\,(0|1))?)?\]([^\[\<\(\r\n\”‘;]+?)\[\/flash\]/eis”, “self::createPlayer(‘\\6′,’\\2′,’\\3′,’\\5′,’video’)”, $message, self::$_cvtimes);
}
return preg_replace(“/\[flash(=(\d+?)\,(\d+?)(\,(0|1))?)?\]([^\[\<\(\r\n\”‘;]+?)\[\/flash\]/eis”, “self::createFlashLink(‘\\6’)”, $message, self::$_cvtimes);
}
res/js/dev/windeditor/plugins/insertVideo/plugin.js （如果存在） 和 res/js/build/windeditor/plugins/insertVideo/plugin.js，编辑器JS文件修复，查找：
function wysiwyg() {
//var reg = /\[flash\s*(?:=\s*(\d+)\s*,\s*(\d+)\s*)?\]\s*(((?!”)[\s\S])+?)(?:”[\s\S]*?)?\s*\[\/flash\]/ig;
var reg = /\[flash=(\d+)\s*,(\d+)\s*,(\d+)\s*\]([\s\S]*?)\[\/flash\]/ig;
var html = $(editorDoc.body).html();
if(!reg.test(html)) {
return;
}
html = html.replace(reg,function(all, $1, $2,$3,$4) {
var width = $1,
height = $2,
auto_play = $3,
url = $4;
return ‘<p><img class=”j_editor_video_content” style=”border:1px dashed #ccc;background:#fffeee url(‘+ img_path +’video_48.png) center center no-repeat;” width=”‘+ width +’px” height=”‘+ height +’px” src=”‘+ img_path +’blank.gif” data-url=”‘+ url +'” data-width=”‘+ width +'” data-height=”‘+ height +'” data-auto=”‘+ auto_play +'”></p>’;
});
$(editorDoc.body).html(html);
}
将整个函数替换为：
function wysiwyg() {
//var reg = /\[flash\s*(?:=\s*(\d+)\s*,\s*(\d+)\s*)?\]\s*(((?!”)[\s\S])+?)(?:”[\s\S]*?)?\s*\[\/flash\]/ig;
//var reg = /\[flash=(\d+)\s*,(\d+)\s*,(\d+)\s*\]([\s\S]*?)\[\/flash\]/ig;
var reg = /\[flash=(\d+)\s*,(\d+)\s*,(\d+)\s*\]([^\[\<\(\r\n\”‘;]+?)\[\/flash\]/ig;
var html = $(editorDoc.body).html();
if(!reg.test(html)) {
return;
}
html = html.replace(reg,function(all, $1, $2,$3,$4) {
var width = $1,
height = $2,
auto_play = $3,
url = $4;
return ‘<p><img class=”j_editor_video_content” style=”border:1px dashed #ccc;background:#fffeee url(‘+ img_path +’video_48.png) center center no-repeat;” width=”‘+ width +’px” height=”‘+ height +’px” src=”‘+ img_path +’blank.gif” data-url=”‘+ url +'” data-width=”‘+ width +'” data-height=”‘+ height +'” data-auto=”‘+ auto_play +'”></p>’;
});
$(editorDoc.body).html(html);
}
无忧主机相关文章推荐阅读：