Question

AJAX加载了xml和xsl，然后将其转换为html。结果节点将导入到html容器中。结果具有带内嵌javascript代码的script元素。 Chrome更新后，将不会执行内联代码。

例如： HTML

<!DOCTYPE html>
    <html xmlns="http://www.w3.org/1999/xhtml">
        <head>
            <title></title>
        </head>
        <body>
            <script>
    let buttonElement = document.createElement("button");
        buttonElement.textContent = "Press me";
        document.body.appendChild(buttonElement);

    buttonElement.addEventListener("click", event => {
        Promise.all([fetch('/test.xml'), fetch('/test.xsl')]).then(result => {
            Promise.all([result[0].text(), result[1].text()]).then(result => {
                let parser = new DOMParser(),
                    xml = parser.parseFromString(result[0], "application/xml"),
                    xsl = parser.parseFromString(result[1], "application/xml"),
                    target = document.body,
                    processor = new XSLTProcessor(),
                    output;

                processor.importStylesheet(xsl);
                output = processor.transformToDocument(xml);

                let newOutput = document.body.appendChild(output.documentElement);
/* 
Uncomment the block below,  the result node its replacement  helps and inline script will be executed properly 
*/
/*              newOutput.querySelectorAll("script").forEach(element => {
                    let replacement = document.createElement("script");
                    replacement.text = element.text;
                    element.replaceWith(replacement);
                });         
*/
            });
        });
    }, false);
            </script>
        </body>
    </html>

XML

<?xml version="1.0" encoding="UTF-8"?>
<hello>
    <world/>
</hello>

XSL

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml">
    <xsl:output method="xml" indent="no"/>
    <xsl:template match="/">
        <div>
            <p>Hello world</p>
            <script>console.log("Test me!");</script>
        </div>
    </xsl:template>
</xsl:stylesheet>

那么，这是Webkit的安全性漏洞吗？因为，此错误也在Opera中检测到。

如果这是安全解决方案，为什么在替换结果节点后成功执行内联脚本？

Chrome XSL Transformation插入脚本节点安全性错误？

0 个答案: