从 HREF 中删除 Javascript
我们希望允许“正常”href 链接到其他网页，但我们不想允许任何人潜入客户端脚本。
正在 HREF 和 onclick/onmouseover/etc 中搜索“javascript:”。 活动够好吗？ 或者还有其他什么需要检查的吗？
We want to allow "normal" href links to other webpages, but we don't want to allow anyone to sneak in client-side scripting.
Is searching for "javascript:" within the HREF and onclick/onmouseover/etc. events good enough? Or are there other things to check?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
听起来您正在允许用户使用标记提交内容。 因此，我建议您看几篇有关防止跨站点脚本编写的文章，这些文章所涵盖的内容不仅仅是防止将 javascript 插入到 HREF 标记中。 下面是我发现可能有用的一个：
http:// weblogs.java.net/blog/gmurray71/archive/2006/09/preventing_cros.html
It sounds like you're allowing users to submit content with markup. As such, I would recommend taking a look at a few articles about preventing cross-site scripting which would cover a bit more than simply preventing javascript from being inserted into an HREF tag. Below is one I found that might be useful:
http://weblogs.java.net/blog/gmurray71/archive/2006/09/preventing_cros.html
您必须使用允许协议的白名单才能完全安全。 如果你使用黑名单，迟早你会错过像“telnet://”或“shell:”这样的东西，或者一些你从未听说过的可利用的浏览器特定的东西......
You'll have to use a whitelist of allowed protocols to be completely safe. If you use a blacklist, sooner or later you'll miss something like "telnet://" or "shell:" or some exploitable browser-specific thing you've never heard of...
不，还有很多事情需要您检查。
第一个 URL 可以被编码（使用 HTML 实体或 URL 编码或两者的混合）。
其次，您需要检查格式错误的 HTML，浏览器可能会猜测并最终允许某些脚本进入。
第三，您需要检查基于 CSS 的脚本，例如：background: url(javascript:...) 或 width:expression(. ..）
我可能错过了更多 - 你需要小心！
Nope, there's a lot more that you need to check.
First of the URL could be encoded (using HTML entities or URL encoding or a mixture of both).
Secondly you need to check for malformed HTML, which the browser might guess at and end up allowing some script in.
Thirdly you need to check for CSS based script, e.g. background: url(javascript:...) or width:expression(...)
There's probably more that I've missed - you need to be careful!
接受用户输入时必须非常小心。 您需要如上所述创建白名单，但不仅仅是使用 href。 示例：
或
You have to be extremely careful when taking user input. You'll want to do a whitelist as mentioned, but not just with the href. Example:
or
一种选择是完全禁止使用 html，并使用某些论坛使用的相同格式。 只需将
[url="xxx"]yyy[/url]替换为
yyy即可解决鼠标悬停等问题。然后只需确保链接以白名单协议开头，并且其中没有引号（
"或一些可能被解密的内容通过 php 或浏览器）。one option would be to disallow html at all and use the same sort of formatting that some forums use. Just replace
[url="xxx"]yyy[/url]with
<a href="xxx">yyy</a>That'll get you around the issues with mouse over etc. Then just make sure the link starts off with a white-listed protocol, and doesn't have a quote in it (
"or some such that might be decrypted by php or the browser).听起来您正在寻找 PHP 的
strip_tags的配套函数，即strip_attributes。 不幸的是，它还没有写出来。 （提示，提示。）但是，
strip_tags文档中有一个看起来很有趣的建议，如下：http://www.php.net/manual/en/function.strip-tags.php#85718
理论上，这会删除任何不是提交链接中的 href、类或 ID； 看起来你可能想进一步锁定它并只获取 href。
Sounds like you're looking for the companion function to PHP's
strip_tags, which isstrip_attributes. Unfortunately, it hasn't been written yet. (Hint, hint.)There is, however, an interesting-looking suggestion in the
strip_tagsdocumentation, here:http://www.php.net/manual/en/function.strip-tags.php#85718
In theory this will strip anything that isn't an href, class, or ID from submitted links; seems like you probably want to lock it down even further and just take hrefs.