web, web前端

当XSS遇到text/plain

今天在做安全检测的时候,发现某网站提供了用户上传文件的接口,并且支持访问该文件。

处于安全考虑,网站域名被我隐藏掉了,网站是需要用户登录才能上传文件的,上传文件后会返回文件的url地址,这个url地址是不需要token的,任何人都可以访问。

如图:

第一反应就是,那我岂不是写什么数据都可以!我写个XSS脚本,然后通过浏览器访问,XSS攻击!

可是当我用浏览器访问时,悲催的一幕发生了:

并没有出现弹窗,XSS注入失败。

第一反应,服务器对于浏览器访问,做了html转义,所有XSS代码都被转义了。通过浏览器查看源码,发现代码好好的,并没有被转义。

再接着找,发现这个接口的header里面有:
Content-Type: text/plain

浏览器遇到text/plain类型,会将内容当做文本显示出来,而我们一般访问网页header应该是:
Content-Type: text/html

虽然没有攻击成功,但是有个想法,我们为什么要用Content-Type,很多时候url地址文件是有后缀的,这个会不会冲突?


如果header是Content-Type: text/html,url网址是img.com/test.jpg,浏览器是显示网页还是显示图片?

上网一查,发现有人问了同样的问题,而且答案竟然也是很神奇!答案会在下面给出。

参考网址:
XSS, Extensions and Content-Types

写这篇文章的哥们目的很明确,输出用户输入的内容时,如何更有效地防范XSS。他对不同的Content-Type、文件扩展名(Extension)、浏览器进行了测试。

yes——表示浏览器可以执行JavaScript
no——表示浏览器不可以执行JavaScript

  • 实验一:一致性测试
  • 在一致性测试中,Content-Type和Extension都是保持一致的,此时XML格式是可以触发JavaScript脚本执行的。

    Content-Type Extension Chrome IE Firefox
    None None yes yes yes
    text/plain txt no no no
    text/html html yes yes yes
    application/javascript js no no no
    application/json json no no no
    application/xml xml yes yes yes
    text/css css no no no
    image/jpeg jpeg no no no
  • 实验二:修改扩展
  • 不论Content-Type是什么,所有扩展全部设置为.html。

    Content-Type Extension Chrome IE Firefox
    None html yes yes yes
    text/plain html no no no
    text/html html yes yes yes
    application/javascript html no yes no
    application/json html no no no
    application/xml html yes yes yes
    text/css html no no no
    image/jpeg html no no no

    结果表明,对于所有html结尾的文件,浏览器会首先检测Content-Type,并不关心文件后缀。

  • 实验三:统一Content-Type
  • 统一Content-Type为text/html,而文件扩展使用不同的格式。

    Content-Type Extension Chrome IE Firefox
    text/html None yes yes yes
    text/html txt yes yes yes
    text/html html yes yes yes
    text/html js yes yes yes
    text/html json yes yes yes
    text/html xml yes yes yes
    text/html css yes yes yes
    text/html jpeg yes no yes

    全部都会解析JavaScript,唯一一个就是当后缀是图片时,IE浏览器不会解析。忽略IE的这个傻逼行为,我们可以得到结论,浏览器重度依赖Content-Type。

  • 实验四:设置Content-Type为text/plain
  • 再做一个类似实验,只是这次把Content-Type设置成text/plain。

    Content-Type Extension Chrome IE Firefox
    text/plain txt no no no
    text/plain html no no no
    text/plain js no no no
    text/plain json no no no
    text/plain xml no no no
    text/plain css no no no
    text/plain jpeg no no no

    结论就是text/plain很安全,不存在XSS注入的可能。

    最后,附上Content-Type和文件扩展映射表:

    文件扩展名 Content-Type(Mime-Type) 文件扩展名 Content-Type(Mime-Type)
    .*( 二进制流,不知道下载文件类型) application/octet-stream .tif image/tiff
    .001 application/x-001 .301 application/x-301
    .323 text/h323 .906 application/x-906
    .907 drawing/907 .a11 application/x-a11
    .acp audio/x-mei-aac .ai application/postscript
    .aif audio/aiff .aifc audio/aiff
    .aiff audio/aiff .anv application/x-anv
    .asa text/asa .asf video/x-ms-asf
    .asp text/asp .asx video/x-ms-asf
    .au audio/basic .avi video/avi
    .awf application/vnd.adobe.workflow .biz text/xml
    .bmp application/x-bmp .bot application/x-bot
    .c4t application/x-c4t .c90 application/x-c90
    .cal application/x-cals .cat application/vnd.ms-pki.seccat
    .cdf application/x-netcdf .cdr application/x-cdr
    .cel application/x-cel .cer application/x-x509-ca-cert
    .cg4 application/x-g4 .cgm application/x-cgm
    .cit application/x-cit .class java/*
    .cml text/xml .cmp application/x-cmp
    .cmx application/x-cmx .cot application/x-cot
    .crl application/pkix-crl .crt application/x-x509-ca-cert
    .csi application/x-csi .css text/css
    .cut application/x-cut .dbf application/x-dbf
    .dbm application/x-dbm .dbx application/x-dbx
    .dcd text/xml .dcx application/x-dcx
    .der application/x-x509-ca-cert .dgn application/x-dgn
    .dib application/x-dib .dll application/x-msdownload
    .doc application/msword .dot application/msword
    .drw application/x-drw .dtd text/xml
    .dwf Model/vnd.dwf .dwf application/x-dwf
    .dwg application/x-dwg .dxb application/x-dxb
    .dxf application/x-dxf .edn application/vnd.adobe.edn
    .emf application/x-emf .eml message/rfc822
    .ent text/xml .epi application/x-epi
    .eps application/x-ps .eps application/postscript
    .etd application/x-ebx .exe application/x-msdownload
    .fax image/fax .fdf application/vnd.fdf
    .fif application/fractals .fo text/xml
    .frm application/x-frm .g4 application/x-g4
    .gbr application/x-gbr . application/x-
    .gif image/gif .gl2 application/x-gl2
    .gp4 application/x-gp4 .hgl application/x-hgl
    .hmr application/x-hmr .hpg application/x-hpgl
    .hpl application/x-hpl .hqx application/mac-binhex40
    .hrf application/x-hrf .hta application/hta
    .htc text/x-component .htm text/html
    .html text/html .htt text/webviewhtml
    .htx text/html .icb application/x-icb
    .ico image/x-icon .ico application/x-ico
    .iff application/x-iff .ig4 application/x-g4
    .igs application/x-igs .iii application/x-iphone
    .img application/x-img .ins application/x-internet-signup
    .isp application/x-internet-signup .IVF video/x-ivf
    .java java/* .jfif image/jpeg
    .jpe image/jpeg .jpe application/x-jpe
    .jpeg image/jpeg .jpg image/jpeg
    .jpg application/x-jpg .js application/x-javascript
    .jsp text/html .la1 audio/x-liquid-file
    .lar application/x-laplayer-reg .latex application/x-latex
    .lavs audio/x-liquid-secure .lbm application/x-lbm
    .lmsff audio/x-la-lms .ls application/x-javascript
    .ltr application/x-ltr .m1v video/x-mpeg
    .m2v video/x-mpeg .m3u audio/mpegurl
    .m4e video/mpeg4 .mac application/x-mac
    .man application/x-troff-man .math text/xml
    .mdb application/msaccess .mdb application/x-mdb
    .mfp application/x-shockwave-flash .mht message/rfc822
    .mhtml message/rfc822 .mi application/x-mi
    .mid audio/mid .midi audio/mid
    .mil application/x-mil .mml text/xml
    .mnd audio/x-musicnet-download .mns audio/x-musicnet-stream
    .mocha application/x-javascript .movie video/x-sgi-movie
    .mp1 audio/mp1 .mp2 audio/mp2
    .mp2v video/mpeg .mp3 audio/mp3
    .mp4 video/mpeg4 .mpa video/x-mpg
    .mpd application/vnd.ms-project .mpe video/x-mpeg
    .mpeg video/mpg .mpg video/mpg
    .mpga audio/rn-mpeg .mpp application/vnd.ms-project
    .mps video/x-mpeg .mpt application/vnd.ms-project
    .mpv video/mpg .mpv2 video/mpeg
    .mpw application/vnd.ms-project .mpx application/vnd.ms-project
    .mtx text/xml .mxp application/x-mmxp
    .net image/pnetvue .nrf application/x-nrf
    .nws message/rfc822 .odc text/x-ms-odc
    .out application/x-out .p10 application/pkcs10
    .p12 application/x-pkcs12 .p7b application/x-pkcs7-certificates
    .p7c application/pkcs7-mime .p7m application/pkcs7-mime
    .p7r application/x-pkcs7-certreqresp .p7s application/pkcs7-signature
    .pc5 application/x-pc5 .pci application/x-pci
    .pcl application/x-pcl .pcx application/x-pcx
    .pdf application/pdf .pdf application/pdf
    .pdx application/vnd.adobe.pdx .pfx application/x-pkcs12
    .pgl application/x-pgl .pic application/x-pic
    .pko application/vnd.ms-pki.pko .pl application/x-perl
    .plg text/html .pls audio/scpls
    .plt application/x-plt .png image/png
    .png application/x-png .pot application/vnd.ms-powerpoint
    .ppa application/vnd.ms-powerpoint .ppm application/x-ppm
    .pps application/vnd.ms-powerpoint .ppt application/vnd.ms-powerpoint
    .ppt application/x-ppt .pr application/x-pr
    .prf application/pics-rules .prn application/x-prn
    .prt application/x-prt .ps application/x-ps
    .ps application/postscript .ptn application/x-ptn
    .pwz application/vnd.ms-powerpoint .r3t text/vnd.rn-realtext3d
    .ra audio/vnd.rn-realaudio .ram audio/x-pn-realaudio
    .ras application/x-ras .rat application/rat-file
    .rdf text/xml .rec application/vnd.rn-recording
    .red application/x-red .rgb application/x-rgb
    .rjs application/vnd.rn-realsystem-rjs .rjt application/vnd.rn-realsystem-rjt
    .rlc application/x-rlc .rle application/x-rle
    .rm application/vnd.rn-realmedia .rmf application/vnd.adobe.rmf
    .rmi audio/mid .rmj application/vnd.rn-realsystem-rmj
    .rmm audio/x-pn-realaudio .rmp application/vnd.rn-rn_music_package
    .rms application/vnd.rn-realmedia-secure .rmvb application/vnd.rn-realmedia-vbr
    .rmx application/vnd.rn-realsystem-rmx .rnx application/vnd.rn-realplayer
    .rp image/vnd.rn-realpix .rpm audio/x-pn-realaudio-plugin
    .rsml application/vnd.rn-rsml .rt text/vnd.rn-realtext
    .rtf application/msword .rtf application/x-rtf
    .rv video/vnd.rn-realvideo .sam application/x-sam
    .sat application/x-sat .sdp application/sdp
    .sdw application/x-sdw .sit application/x-stuffit
    .slb application/x-slb .sld application/x-sld
    .slk drawing/x-slk .smi application/smil
    .smil application/smil .smk application/x-smk
    .snd audio/basic .sol text/plain
    .sor text/plain .spc application/x-pkcs7-certificates
    .spl application/futuresplash .spp text/xml
    .ssm application/streamingmedia .sst application/vnd.ms-pki.certstore
    .stl application/vnd.ms-pki.stl .stm text/html
    .sty application/x-sty .svg text/xml
    .swf application/x-shockwave-flash .tdf application/x-tdf
    .tg4 application/x-tg4 .tga application/x-tga
    .tif image/tiff .tif application/x-tif
    .tiff image/tiff .tld text/xml
    .top drawing/x-top .torrent application/x-bittorrent
    .tsd text/xml .txt text/plain
    .uin application/x-icq .uls text/iuls
    .vcf text/x-vcard .vda application/x-vda
    .vdx application/vnd.visio .vml text/xml
    .vpg application/x-vpeg005 .vsd application/vnd.visio
    .vsd application/x-vsd .vss application/vnd.visio
    .vst application/vnd.visio .vst application/x-vst
    .vsw application/vnd.visio .vsx application/vnd.visio
    .vtx application/vnd.visio .vxml text/xml
    .wav audio/wav .wax audio/x-ms-wax
    .wb1 application/x-wb1 .wb2 application/x-wb2
    .wb3 application/x-wb3 .wbmp image/vnd.wap.wbmp
    .wiz application/msword .wk3 application/x-wk3
    .wk4 application/x-wk4 .wkq application/x-wkq
    .wks application/x-wks .wm video/x-ms-wm
    .wma audio/x-ms-wma .wmd application/x-ms-wmd
    .wmf application/x-wmf .wml text/vnd.wap.wml
    .wmv video/x-ms-wmv .wmx video/x-ms-wmx
    .wmz application/x-ms-wmz .wp6 application/x-wp6
    .wpd application/x-wpd .wpg application/x-wpg
    .wpl application/vnd.ms-wpl .wq1 application/x-wq1
    .wr1 application/x-wr1 .wri application/x-wri
    .wrk application/x-wrk .ws application/x-ws
    .ws2 application/x-ws .wsc text/scriptlet
    .wsdl text/xml .wvx video/x-ms-wvx
    .xdp application/vnd.adobe.xdp .xdr text/xml
    .xfd application/vnd.adobe.xfd .xfdf application/vnd.adobe.xfdf
    .xhtml text/html .xls application/vnd.ms-excel
    .xls application/x-xls .xlw application/x-xlw
    .xml text/xml .xpl audio/scpls
    .xq text/xml .xql text/xml
    .xquery text/xml .xsd text/xml
    .xsl text/xml .xslt text/xml
    .xwd application/x-xwd .x_b application/x-x_b
    .sis application/vnd.symbian.install .sisx application/vnd.symbian.install
    .x_t application/x-x_t .ipa application/vnd.iphone
    .apk application/vnd.android.package-archive .xap application/x-silverlight-app

    1 Comment

    1. hello

      然而实际是可以xss的.... 哈哈哈哈哈哈哈

    Leave a Reply

    黑ICP备15001596号