javascript - 如何在脚本标签内使用html编码的xss攻击向量触发xss？

Question

我正在阅读 OWASP XSS 预防备忘单，并陷入了理解的困境:

Why Can't I Just HTML Entity Encode Untrusted Data

HTML entity encoding is okay for untrusted data that you put in the body of the HTML document, such as inside a <div> tag. It even sort of works for untrusted data that goes into attributes, particularly if you're religious about using quotes around your attributes. But HTML entity encoding doesn't work if you're putting untrusted data inside a <script> tag anywhere, or an event handler attribute like onmouseover, or inside CSS, or in a URL. So even if you use an HTML entity encoding method everywhere, you are still most likely vulnerable to XSS. You MUST use the encode syntax for the part of the HTML document you're putting untrusted data into. That's what the rules below are all about.

我无法创建一个有效的 POC，html 编码的 xss 攻击向量如何在 <script> 内触发 xss标签

帮助我理解这一点。

Answer 1

HTML编码是指替换<与 < , >与 > ，和&与 & (以及其他替代品)。该段落的意思是，这确实会阻止普通标签内的 XSS，例如，如果您尝试注入(inject) <script>alert(1)</script>进入p标签，你得到:

<p>&gt;script&lt;alert(1)&gt;/script&lt;</p>

它没有做任何事情。但是，如果 XSS 向量位于 script 标记而不是 p 标记内，则您只需输入 alert(1)最终结果是:

<script>alert(1)</script>

这会导致 XSS。