jQuery DOM XSS漏洞

JQuery DOM方法中XSS漏洞：

漏洞截图：

测试代码：

 

    
XSS vulnerabilities in jQuery DOM methods

    


    
Input
    

        
        
    

    


    
Output (native innerHTML)
    
The HTML5 spec states that script tags inserted via innerHTML will not be executed.
    

        Injection goes here...
    

    
Output ($.html())
    
jQuery DOM methods strip and eval() any script tags passed in, exposing an XSS vulnerability.
    

        Injection goes here...
    

    
Output ($.text())
    
This method treats the passed string as a textNode, preventing it from being executed by the browser.
    

        Injection goes here...
    

参考链接：jQuery DOM方法中的XSS漏洞演示 - 踏得网