Walks

网络安全爱好者

postMessage跨域

前言:

postMessage是HTML5衍生出来的,用来规范跨域的问题。但由于使用者不注意一些安全性,可能会产生一些漏洞,这篇文章介绍可能产生的问题。

 

目录:

0x01:如何工作

0x02:可能的三个漏洞

0x03:正确代码


如何工作

    为了跨域去发送一些数据,应用会用如下的语句去发送

targetWindow.postMessage(data, "*");
data为数据,"*"为接收端

    

    为了去接受一些数据,接收端会添加一个事件监听器用来接受跨域传输过来的数据

window.addEventListener("message", function(message){console.log(message.data)});

    

    可能的三个问题

    Issue One:

targetWindow.postMessage(data, "*");

    

    如上代码,第一个问题就产生在这里,当postMessage的第二个参数为"*"时,也就意味着数据可以被跨域传送到任何地方,如果这个数据为个人数据或者其他隐私呢?结果显而易见。

    

   Issue Two:

//Listener on  
window.addEventListener("message", function(message){
    if(/^http://www.bywalks.com$/.test(message.origin)){
         console.log(message.data);
   }});

    

    如上代码,这是产生在接收端的问题。上面的代码通过正则来规范传输端,这里我们要着重关注".",你看出问题了么?origin可以是http://www.bywalks.com,同时也可以是http://wwwabywalks.com,因为在正则里面,"."匹配\r之外的任意单字符。

 

    Issue Three:

//Listener on  
window.addEventListener("message", function(message){
   if(/^http://www\.bywalks\.com$/.test(message.origin)){
      document.getElementById("message").innerHTML = message.data;
   }});

    

    这是一个基于DOM的XSS,如上代码,id=message的事件文本内容为跨域传送来的data,这里规范了origin为http://www.bywalks.com

    那么是否我们在http://www.bywalks.com(传输端)上面找到一个XSS漏洞,也就意味着在接收端找到一个XSS漏洞呢?要知道,在网站上载入第三方JS是一个很常见的事。

    

    正确代码

var data = JSON.parse(decodeURIComponent(document.getElementById('data').value));

// cross browser origin determination
var origin = (window.location.protocol + '//' + window.location.hostname
  + (window.location.port ? ':' + window.location.port : ''));

if (window.opener) {
  window.opener.postMessage(data, origin);
} else {
  // attempt to redirect back to the origin
  window.location = origin;
}

    如上代码,这里就规范了origin,避免产生把data发送到其他网站的信息泄露事件、

点赞
  1. 说道:

    沙发,想和您合作视频课程,有兴趣吗? :biggrin:

    1. walks说道:

      考研中..

  2. Johnc683说道:

    Just wanna remark on couple of general issues, The web site style is perfect, the subject matter is rattling excellent cbefedgdekbe

  3. GeraldThora说道:

    Milf anal interracial
    Culo grande, redondo y aceitado
    Beautiful Curvy Latina Webcam Oil Teaser
    https://porno-canal.com/ver/asiatica-empalada-por-un-megapollon/ AsiГЎtica empalada por un MegaPollГіn - Canalporno.com
    HГєmeda y pringosa Shyla Stylez
    Colegiala asiГЎtica come el rabo de una transexual
    Masturbation Spielzeug Closeup Video

  4. KennethTycle说道:

    Добрый день.РекомендуюВсемобратить вниманиеСайтanti-spazm.ru . Тут Вы увидетеконтент о спазмах сосудов в рунете.
    спазм кишечника симптомы

  5. XEvilBestDub说道:

    Yep, f*kin sp*am. Yes, yes, yes, AGAIN. And - yes, IT F*KIN WORKS BECAUSE YOU READ IT! :)
    Because XEvil 4.0 WAS RELEASED! It's bypass ANY captcha included ReCaptcha-2 and ReCaptcha-3.
    Neeed more info (just to...maybe kill this Evil? ;))

    Just Google or YouTube for it.
    You'll be impressed.

    Peace to you, bro! :)

  6. MarlonfeepE说道:

    Hi there! buy propecia lloyds pharmacy good internet site.

  7. curtisqa18说道:

    Sexy blog pictures from internet
    erotic obsession erotic madonna erotic french films greek erotic hardcore sex
    http://pornstars.erolove.in/?janessa
    erotic asphyxiation erotic writing erotic paint por xxx videos erotic cakes

  8. MarlonfeepE说道:

    Hello! buy propecia in australia very good site.

  9. lesliesn11说道:

    Chit my recent project
    app droid free download sono app free messaging apps for android online sex games best androids phone
    http://erotic.googleplay.twiclub.in/?leaf.arianna
    android application tutorial sexy photo wallpapers free download games for phones htc mobile latest best android app to download

  10. MarlonfeepE说道:

    Hi there! buy propecia defense very good web site.

  11. MarlonfeepE说道:

    Hello there! finasteride cheaper than propecia very good web page.

  12. MarlonfeepE说道:

    Hi there! buy propecia online in india great site.

  13. francescatq60说道:

    New adult blog website
    find a woman quotes waist cinchers and corsets motorcycle seat bags
    http://sissy.adultnet.in/?view.kelsey
    cheap clubbing holidays making a bra chastity fetish video white women pay for sex with black men stretch jeans for women slang online hair salon shops maЕ‚e bikini

  14. "When you get into a habit [url=http://www.wholesalejerseysinsist.us.com/]Wholesale NBA Jerseys[/url] of going against the same person, you pick up on little keys and tendencies that they have, and you can sometimes play out of [url=http://www.cheapchinawholesalejerseys.us.com/]China NFL Jerseys[/url] your technique," Colts tight end Dwayne Allen said. "But going against someone new forces you to get back to [url=http://www.wholesalejerseys2018.us.com/]Wholesale Hockey Jerseys 2018[/url] the basics."
    Cheap China Jerseys http://www.cheapchinawholesalejerseys.us.com/

  15. ShannonRak说道:

    Hi! best online pharmacy for cialis beneficial web site.

  16. ShannonRak说道:

    Howdy! levitra online pharmacy beneficial web site.

  17. janero18说道:

    Latin ladyboys
    http://futanari.replyme.pw/?private.berenice
    seamale sex shemla.com shaemle video shemaler semales video

  18. Martinexhit说道:

    Hi there! buy propecia uk cheap good internet site.

  19. Martinexhit说道:

    Hello! buy propecia with prescription excellent web page.

  20. RobertZem说道:

    Hello! on line drugs no prescription good web site.

  21. RobertZem说道:

    Hello there! no precription online pharmacy vote great web site.

  22. Peterstarm说道:

    viagra without a doctor prescription usa viagra without a doctor prescription uk viagra without a doctor prescription india

  23. MelvinGig说道:

    Howdy! Online Pharmacy great web page.

  24. MelvinGig说道:

    Howdy! cialis online pharmacy excellent web page.

  25. MelvinGig说道:

    Hello! pharmacy tech classes online very good web page.

  26. SergioHidar说道:

    Предлагаю Интернет Рекламу от 10 usd за Месяц https://clck.ru/EZqnP. ОПЫТ 25 лет 1. Это размещение Вашего Объявления ( типа этого) на 10 000 Досках Объявлений, формах, гостевых и т.д. и более за 10 usd за месяц. 2. Обучение интернет рекламе = 50 usd за месяц, 2. Консультации. Ответы на почти все вопросы по программам, видам заработка, проверка проектов на обман, соц.сетям, компьютеру, YouTube, продвижению и раскрутке сайта и продукта, услуг, товара = 20 usd на месяц. 3. Pinterest Профессионально. Практически все виды работ по пинтересту = 30 usd за месяц. 4. Помощь в продажах - комплекс рекламы = от 50 usd Большой рекламной работы за Месяц. И Заработок Без вложений на AminoBoosters ( aminopure, aminoserene ) от д-ра Эскеланд дешевле Ламинина (Laminine LPGN) в 3-6 раз. Спасает, когда врачи бессильны. Sкyре evg7773 Viber +380976131437 Серьезный проект для серьезных людей

  27. ClydeSib说道:

    Hello there! online pharmacy adderall excellent web site.

  28. WalthonTyday说道:

    Prom Electric Ремонт частотного преобразователя Delta VFD004EL11A ID:yRWWENarqazicNofd2M2Q6sCtHGfCJ7lzmcLYf5Q49TdCyhuB9VDYr9gasMzDJquF

  29. thomasol18说道:

    Blog with daily sexy pics updates
    http://hotpic.erolove.in/?post.deasia
    free intercourse movies of mature women tiny teen porn toddler cold hands and feet sweaty head neolamplogus cichlid pictures sex slaves indian videos

  30. CurtisgoG说道:

    Срочный ремонт домофонов в Москве

    kocom kvm 604 Ремонт домофонов Москва.......

  31. BryceskypE说道:

    Our services are the simplest system of Low priced Unique Writings. Accordingly, finding the product doesn't depart without the need of consideration our freelance writers. You will possess the ideally suited provider when you finally essay order on the web from us. Excellent company at competitively cheap unique articles reviews customwritings.

    Our system offers you the terrific essay which won't be compared to all other works out your friends. Our creating professional services are considered the best option. Our cheap crafting products are merely matchless.

    cheap essay service

发表评论

电子邮件地址不会被公开。 必填项已用*标注