uchome 2.0 ־XSSվ©޸

ҳԶʱ@importⲿcssļ
 
uchome utf-8 2.0IE6,IE7,IE8ͨ.
@import url(http://xxx.com/1.css); Զcssļ1.cssдXSS.
 cp_theme.php 92(17е)
 
 
 
function checksecurity($str) { //ִһϵеĹ֤ǷϷCSS $filter = array( //*[ ]*(.+?)[ ]**//is, /[^a-z0-9]+/i, ); $str = preg_replace($filter, , $str); //ǹˣֻжϣûԴ if(preg_match("/(expression|implode|javascript)/i", $str)) { //ûжimporthttpȽм showmessage(css_contains_elements_of_insecurity); } return true; }
 
޸implodeӦimportı

 
/(expression|vbscript|javascript|import)/i
