通过 ![]()
-tag 注入 javascript
我想知道是否可以通过 img 标签注入一些 javascript 代码。场景是设置一个像这样的 html 页面
<img src="anotherdomain.com/someimage.jpg" />
Anotherdomain is mydomain。是否可以将对 /someimage.jpg 的调用重定向到另一个包含 som javascript 代码的文件，该代码在请求图像时执行？
I would like to know if it is possible to inject some javascript code through an img-tag. The scenario is that one sets up a html-page like this
<img src="anotherdomain.com/someimage.jpg" />
Anotherdomain is my domain. Is it possible to redirect the call for /someimage.jpg to another file containing som javascript code that is executed when the image is requested?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
浏览器不应尝试将通过
![]()
作为基本安全原则，浏览器只会执行
The browser should not make an attempt to execute code received via an
<img>tag as JavaScript. The script would be delivered to the browser, but in its place would be a broken image that could not be displayed.Browsers will only execute scripts received in a
<script>tag oronclick,onmouseover,onmouseout,etc...attributes as a basic security principle不，目前所有主流浏览器都不接受 JavaScript 代码
no, all major browser will not accept javascript code at this point
不。问题（如果你想这样称呼它）是有问题的 URL 被解释为图像数据，而不是 JS 脚本。因此，无论它是什么或如何重定向，它都不会被评估为 JS。
注意：<脚本>标签可以跨域工作，所以你应该使用它。
No. The problem (if you want to call it that) is that the URL in question is interpreted as image data, not as a JS script. So regardless of what it is or how it's redirected, it's not going to get evaluated as JS.
Note: <script> tags work cross-domain, so you should probably just use that.