javascript - 将 HREF 与 jQuery 结合使用是否容易受到 XSS 攻击？

Question

Burp suite显示错误。

The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to jQuery() via the following statement: here location is javascript location object containing current address hash jQuery(location).attr('href').split("//")[1]; is the above code vulnerable to cross site scripting?

在下面的代码中使用了

var address = jQuery(location).attr('href').split('//')[1]; 
subdomain = address.split('.')[0]; 
this.href = this.href.replace(subdomain, 'www'); 
window.location = this.href;

Answer 1

似乎是一个误报错误。其他人也有类似的经历。

Burp suite 支持中心的一位人员表示:

The code is very close to being exploitable. If it was:

$(location).attr(‘href’, ‘’ + var1 + ’/’);

And var1 could be controlled by an attacker, they could inject “javascript:alert(document.domain)” and that would be executed. However, prepending the slash will prevent this.

Our static analysis is likely to produce false positives on similar patterns, as we don’t attempt to do string analysis.

Page of thread above

因此，只要您不允许变量进入您的 href 属性，那么您就可以了。在这种情况下，您似乎只读取 href 属性值。