王鸡娃 comments

Repositories
Issues
Comments

Results 2 comments of


                                            王鸡娃

yakit 插件仓库不当设计

收到了的确需要个提示！

OWASP Dependency Check flagged RetireJS vulnerability pkg:javascript/[email protected] in swagger-ui-bundle.js provided by springfox-swagger-ui-3.0.0.jar

> Can someone please look into this? Thanks. 我最近在渗透测试中有遇到过大概是因为MathML、SVG 等标签可绕过净化逻辑，造成反射型 XSS。这是一个突变的xss 浏览器直接访问 Swagger-UI 页面，且 URL 参数被回显到页面则大概率存在该漏洞可以使用以下poc进行测试 /swagger-ui/index.html?configUrl=javascript:alert(1)//x.json