exec（document.cookie）它脆弱吗？

发布于 2025-02-02 10:58:44 字数 394 浏览 1 评论 0原文

function readCookie(name) {
return (name = new RegExp('(?:^|;\\s*)' + ('' + name).replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&') + '=([^;]*)').exec(document.cookie)) && name[1];

大家好，我是安全测试仪，我不习惯测试网络安全性，所以我在这里向您询问任何帮助。查看应用程序页面代码，我发现它令我担心的“ exec”。我试图通过Firefox调试器设置一个中断点，但我无法做我想要/需要的事情。我的问题是：是否真的有可能连接发出命令执行利用的命令？我是否将其报告为可能的流程，或者没有任何问题？非常感谢

Noyse

原文

function readCookie(name) {
return (name = new RegExp('(?:^|;\\s*)' + ('' + name).replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\amp;') + '=([^;]*)').exec(document.cookie)) && name[1];

Hello to everyone,
I'm security tester, I'm not used to test web security, so I'm here to ask you any help.
Looking at the application page code, I've found that "exec" that it worries me. I tried to set up an interruption point with the Firefox debugger, but I can't do what I want/need. My question is: is it really possible to concatenate a command issuing a command execution exploit? Have I to report it as a possible flow, or there aren't any problems?
Thank a lot

noyse

分享到QQ

分享到微博