Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using XML format for obfuscation #3819

Open
weaweawe01 opened this issue May 17, 2024 · 0 comments
Open

Using XML format for obfuscation #3819

weaweawe01 opened this issue May 17, 2024 · 0 comments

Comments

@weaweawe01
Copy link

weaweawe01 commented May 17, 2024

If executed in the browser, alert (1) will be executed successfully.

<svg><qwe></qwe><script><!--123-->a<qwe>123</qwe>l</>e</>r</1>t&#40;<![CDATA[1)]]></script></svg>

image

I don't know which method to use now. The content obtained by enabling recognizeCDATA is a123lert (1)

Code

const cheerio = require('cheerio');

code =`
<svg><qwe></qwe><script><!--123-->a<qwe>123</qwe>l</>e</>r</1>t&#40;<![CDATA[1)]]></script></svg>

`;
cc = cheerio.load(code,{normalizeWhitespace:true,recognizeCDATA:true},false);
console.log(cc.html());
cc('*').each(function() {
    let tagName = this.tagName;
    let scriptContent = cc(this).text();
    console.log('tagName:', tagName, 'scriptContent:', scriptContent);
    });

image

How can I correctly obtain the actual value for this situation.

The content displayed by the browser

image

Actually, this feels like a browser issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant