Google漏洞过滤规则研究-阿里云开发者社区

Google漏洞过滤规则研究

2017-08-11 1084

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

简介： 1、通过Protobuf的代码发现了过滤逻辑goog.string.AMP_RE_ = /&/g;goog.

1、通过Protobuf的代码发现了过滤逻辑

goog.string.AMP_RE_ = /&/g;
goog.string.LT_RE_ = /</g;
goog.string.GT_RE_ = />/g;
goog.string.QUOT_RE_ = /"/g;
goog.string.SINGLE_QUOTE_RE_ = /'/g;
goog.string.NULL_RE_ = /\x00/g;
goog.string.E_RE_ = /e/g;
goog.string.ALL_RE_ = goog.string.DETECT_DOUBLE_ESCAPING ? /[\x00&<>"'e]/ : /[\x00&<>"']/;

goog.string.htmlEscape = function(str, opt_isLikelyToContainHtmlChars) {
  if (opt_isLikelyToContainHtmlChars) {
    str = str.replace(goog.string.AMP_RE_, "&amp;").replace(goog.string.LT_RE_, "&lt;").replace(goog.string.GT_RE_, "&gt;").replace(goog.string.QUOT_RE_, "&quot;").replace(goog.string.SINGLE_QUOTE_RE_, "&#39;").replace(goog.string.NULL_RE_, "&#0;"), goog.string.DETECT_DOUBLE_ESCAPING && (str = str.replace(goog.string.E_RE_, "&#101;"));
  } else {
    if (!goog.string.ALL_RE_.test(str)) {
      return str;
    }
    -1 != str.indexOf("&") && (str = str.replace(goog.string.AMP_RE_, "&amp;"));
    -1 != str.indexOf("<") && (str = str.replace(goog.string.LT_RE_, "&lt;"));
    -1 != str.indexOf(">") && (str = str.replace(goog.string.GT_RE_, "&gt;"));
    -1 != str.indexOf('"') && (str = str.replace(goog.string.QUOT_RE_, "&quot;"));
    -1 != str.indexOf("'") && (str = str.replace(goog.string.SINGLE_QUOTE_RE_, "&#39;"));
    -1 != str.indexOf("\x00") && (str = str.replace(goog.string.NULL_RE_, "&#0;"));
    goog.string.DETECT_DOUBLE_ESCAPING && -1 != str.indexOf("e") && (str = str.replace(goog.string.E_RE_, "&#101;"));
  }
  return str;
};

2、过滤一些特殊字符

oog.string.specialEscapeChars_ = {"\x00":"\\0", "\b":"\\b", "\f":"\\f", "\n":"\\n", "\r":"\\r", "\t":"\\t", "\x0B":"\\x0B", '"':'\\"', "\\":"\\\\", "<":"<"};

goog.string.jsEscapeCache_ = {"'":"\\'"};

" >>>>>> \"

3、 URLENCODE

对URL中一些请求进行服务端URLENCODE后输出；

4、HTML过滤

f.string.Sj = function(a, c) {
if (c) a = a.replace(f.string.IG, "&").replace(f.string.GH, "<").replace(f.string.DH, ">").replace(f.string.ZH, """).replace(f.string.cI, "'").replace(f.string.NH, ""), f.string.Gy && (a = a.replace(f.string.AH, "e"));
else {
if (!f.string.SU.test(a)) return a; - 1 != a.indexOf("&") && (a = a.replace(f.string.IG, "&")); - 1 != a.indexOf("<") && (a = a.replace(f.string.GH, "<")); - 1 != a.indexOf(">") && (a = a.replace(f.string.DH, ">")); - 1 != a.indexOf('"') && (a = a.replace(f.string.ZH,
""")); - 1 != a.indexOf("'") && (a = a.replace(f.string.cI, "'")); - 1 != a.indexOf("\x00") && (a = a.replace(f.string.NH, ""));
f.string.Gy && -1 != a.indexOf("e") && (a = a.replace(f.string.AH, "e"))
}
return a
};
f.string.IG = /&/g;
f.string.GH = /</g;
f.string.DH = />/g;
f.string.ZH = /"/g;
f.string.cI = /'/g;
f.string.NH = /\x00/g;
f.string.AH = /e/g;
f.string.SU = f.string.Gy ? /[\x00&<>"'e]/ : /[\x00&<>"']/;
f.string.nG = function(a) {
return f.string.contains(a, "&") ? !f.string.n0 && "document" in f.global ? f.string.gU(a) : f.string.Jka(a) : a
};