XPS 文档的安全性如何？
XPS 文档的安全性如何？从 XPS 文档内部查看后，找到了 Unicode-string 属性。有人可以将脚本注入到 Unicode 字符串属性中吗？
XPS 查看器如何处理 Unicode 字符串属性？作为字形的集合还是什么？
更新：我将以下字符串添加为 UnicodeText
!@#$%^&*()_+
，但 XPS 查看器拒绝打开该文件。这就是我想到这个问题的方式
How secure are XPS documents? After looking from the inside of an XPS document, found the Unicode-string property. Could someone inject e.x. a script into the Unicode string property?
How does the XPS viewer treat the Unicode string property? As a collection of glyphs or what?
UPDATE: I added the following string as UnicodeText
!@#$%^&*()_+
and the XPS viewer refused to open the file. This is how this question came into my mind
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
XPS 文档，与（咳嗽）不同，某些其他格式不能包含脚本或活动内容。它们仅用作高保真预打印格式。话虽这么说，XPS 解析器包含安全漏洞并非完全不可能。他们可能会被利用。不过，到目前为止我还没有听说过任何此类漏洞。
但回到你的观点。如果有人想将脚本放入 XPS 文档中的字符串中，他当然可以这样做。他只是不应该指望它会被执行。如果某些软件实际上这样做，那么这可能是该软件的安全问题，而不是文件格式的问题。
仅仅因为您可以将恶意软件放入文本文件中（还记得 iloveyou.vbs 吗？），并不意味着文本文件本身存在安全漏洞:-)
ETA： 相关 UnicodeString 属性有助于在内部进行搜索XPS 文件：
虽然字符串本身应该采用某种格式（在第 115 页的标准中也有详细说明），但查看者不想接受您的输入的原因是它甚至不是格式良好的 XML，因为与符号 (
&) 显示为未转义。我认为如果按照 XML 的要求将 & 符号编码为&，它就会起作用。该规范还指出但即使这样，UnicodeString 属性与文档其他部分之间的关系也相当复杂。他们用了半页多的篇幅来阐述哪些组合有效，哪些组合无效。所以我建议你先阅读一下，然后再尝试进一步:-)
XPS documents, as opposed to (coughs) some other format cannot contain scripts or active content. They are only used as a high-fidelity pre-print format. That being said, it's not entirely impossible for XPS parsers to contain security vulnerabilities. And they can be exploited. So far I haven't heard of any such exploits, though.
But back to your point. If someone wants to put a script into a string in an XPS document he can surely do so. He just shouldn't expect it to be executed. If some software actually does that, then it's probably a security problem with the software and not with the file format.
Just because you can put malware into a text file (remember iloveyou.vbs?) that doesn't mean that text files themselves have a security vulnerability :-)
ETA: The UnicodeString attribute in question aids searching inside the XPS file:
And while the string itself is expected to be in a certain format (also detailed in the standard on page 115), the reason why the viewer didn't want to accept your input is that it's not even well-formed XML since the ampersand (
&) appears unescaped. I assume that it would work if you encode the ampersand as&as required by XML. The spec also states thatBut even with that in place, the relationship between the UnicodeString attribute and other parts of the document are quite intricate. They wrote over half a page on that and which combinations are valid and which are not. So I'd suggest you read up on that first, before trying to play around further :-)
XPS 1.0 规范第 95 页：“标准 XML 转义机制用于指定 XML 保留字符。”
'&'可能会带来麻烦。
p.95 of the XPS 1.0 spec: "The standard XML escaping mechanisms are used to specify XML-reserved characters."
The '&' might be causing troubles.