Mirrors
/
noscript
mirror of https://github.com/hackademix/noscript.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[XSS] More accurate base64 checks on hash.

This commit is contained in:
hackademix 2020-02-29 19:41:17 +01:00
parent 8e90f2a8fe
commit fad07d98d6
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/xss/InjectionChecker.js
View File

@ -890,14 +890,14 @@ XSS.InjectionChecker = (async () => {
async checkBase64(url) {
this.base64 = false;
this.log(url);
let hashPos = url.indexOf("#");
if (hashPos !== -1) {
if (await this.checkBase64FragEx(unescape(url.substring(hashPos + 1))))
return true;
url = url.substring(0, hashPos);
}
var parts = url.split("#"); // check hash
if (parts.length > 1 && await this.checkBase64FragEx(unescape(parts[1])))
return true;
parts = parts[0].split(/[&;]/); // check query string
let parts = url.substring(0, hashPos).split(/[&;]/); // check query string
for (let p of parts) {
var pos = p.indexOf("=");
if (pos > -1) p = p.substring(pos + 1);