为什么单击按钮时不弹出此警告框？答案

【问题标题】：Why is this alert box not popping up when button clicked?为什么单击按钮时不弹出此警告框？
【发布时间】：2017-09-27 00:22:04
【问题描述】：

我一直在编写一个脚本来检查反射型 XSS 漏洞。到目前为止，它有一个用 * 代替查询的 URL 输入和一个用于格式错误 URL 的错误检查器。它还有一个文件上传器供用户上传“有效负载”。但是，我最近做了一个部分，将 * 替换为有效负载的内容，然后出于调试目的，我将其设置为 alert() 带有文件内容的变量。但是，它不起作用。这是我的代码：

function selectPayload(y) {

  var fr = new FileReader();
  fr.readAsText(document.getElementById('file').files[0]);
  fr.onload = function() {

    var dir = fr.result;
    var payload = y.replace("*", fr.result);
    alert(payload);

  };

}

function myFunction() {

  var errors = [];
  var x = document.getElementById("myText").value;

  if (!x.includes("http://") && !x.includes("https://")) {

    errors.push('missing HTTP or HTTPS in URL');

  }

  if (!x.includes("*")) {

    errors.push('missing * in place of query')

  }

  // Renders errors
  if (errors.length) {

    x = 'Error: ' + errors.join(', ') + '!';

  }

  document.getElementById("demo").innerHTML = x;
  selectPayload(x);

}

<!DOCTYPE html>

<html>

<head>

  <title>Slingshot.XSS</title>

</head>

<body style="font-family:monospace;" align="center">

  <h2>Slingshot.XSS</h2>
  <h3>Slingshot.XSS is a script that launches pre-loaded XSS payloads at a target to test its vulnerabilities.</h3>
  <h4>Please report all issues to
    <a href="https://github.com/keeganjk/slingshot.xss/issues"></a> or contact me at email@example.com.</h4>
  <a href="github.com/keeganjk/slingshot.xss" style="font-family:monospace" align="center">Source Code / Learn More</a>
  <br />

  <h4>Enter a URL with <b>*</b> in the place of query.</h4>
  <h5>Example: <code>https://www.google.com/#q=*</code></h5>
  <input type="text" id="myText" placeholder="Enter a URL"> <button onclick="myFunction()">Submit</button>
  <p id="demo">No Submitted URL</p>

  <h4>Select a payload:</h4>
  <h5>Default payloads in <code>payloads</code></h5>
  <input type="file" id="file"> <button onclick="selectPayload()">Submit</button>

</body>

</html>

我做错了什么？

【问题讨论】：

您收到错误消息，因为 y 未定义并且您尝试在其上使用 replace。在文件输入提交按钮的onclick 上，您调用selectPayload 而不是myFunction

标签： javascript html input replace alert

【解决方案1】：

您的第二个按钮调用了错误的函数。改为调用myFunction() 而不是selectPayload()。除非您打算使用第二个按钮调用 selectPayload()，在这种情况下，您需要向它传递预期的参数。

function selectPayload(y) {

  var fr = new FileReader();
  fr.readAsText(document.getElementById('file').files[0]);
  fr.onload = function() {

    var dir = fr.result;
    var payload = y.replace("*", fr.result);
    alert(payload);

  };

}

function myFunction() {

  var errors = [];
  var x = document.getElementById("myText").value;

  if (!x.includes("http://") && !x.includes("https://")) {

    errors.push('missing HTTP or HTTPS in URL');

  }

  if (!x.includes("*")) {

    errors.push('missing * in place of query')

  }

  // Renders errors
  if (errors.length) {

    x = 'Error: ' + errors.join(', ') + '!';

  }

  document.getElementById("demo").innerHTML = x;
  selectPayload(x);

}

<!DOCTYPE html>

<html>

<head>

  <title>Slingshot.XSS</title>

</head>

<body style="font-family:monospace;" align="center">

  <h2>Slingshot.XSS</h2>
  <h3>Slingshot.XSS is a script that launches pre-loaded XSS payloads at a target to test its vulnerabilities.</h3>
  <h4>Please report all issues to
    <a href="https://github.com/keeganjk/slingshot.xss/issues"></a> or contact me at keeganjkuhn@gmail.com.</h4>
  <a href="github.com/keeganjk/slingshot.xss" style="font-family:monospace" align="center">Source Code / Learn More</a>
  <br />

  <h4>Enter a URL with <b>*</b> in the place of query.</h4>
  <h5>Example: <code>https://www.google.com/#q=*</code></h5>
  <input type="text" id="myText" placeholder="Enter a URL"> <button onclick="myFunction()">Submit</button>
  <p id="demo">No Submitted URL</p>

  <h4>Select a payload:</h4>
  <h5>Default payloads in <code>payloads</code></h5>
  <input type="file" id="file"> <button onclick="myFunction()">Submit</button>

</body>

</html>

【讨论】：

【解决方案2】：

在这里：我找到了可行的代码：

<!DOCTYPE html>

<html>

<head>

  <title>Slingshot.XSS</title>

</head>

<body style="font-family:monospace;" align="center">

  <script> 

    function selectPayload() {

      var x = document.getElementById("myText").value;
      var fr = new FileReader();
      fr.readAsText(document.getElementById('file').files[0]);
      fr.onload = function() {

        var dir = fr.result;
        var payload = x.replace("*", fr.result);
        alert(payload);

      };

    }

    function myFunction() {

      var errors = [];
      var x = document.getElementById("myText").value;

      if (!x.includes("http://") && !x.includes("https://")) {

        errors.push('missing HTTP or HTTPS in URL');

      }

      if (!x.includes("*")) {

        errors.push('missing * in place of query')

      }

      // Renders errors
      if (errors.length) {

        x = 'Error: ' + errors.join(', ') + '!';

      }

      document.getElementById("demo").innerHTML = x;

      }


  </script>

  <h2>Slingshot.XSS</h2>
  <h3>Slingshot.XSS is a script that launches pre-loaded XSS payloads at a target to test its vulnerabilities.</h3>
  <h4>Please report all issues to
    <a href="https://github.com/keeganjk/slingshot.xss/issues"></a> or contact me at keeganjkuhn@gmail.com.</h4>
  <a href="github.com/keeganjk/slingshot.xss" style="font-family:monospace" align="center">Source Code / Learn More</a>
  <br />

  <h4>Enter a URL with <b>*</b> in the place of query.</h4>
  <h5>Example: <code>https://www.google.com/#q=*</code></h5>
  <input type="text" id="myText" placeholder="Enter a URL"> <button onclick="myFunction()">Submit</button>
  <p id="demo">No Submitted URL</p>

  <h4>Select a payload:</h4>
  <h5>Default payloads in <code>payloads</code></h5>
  <input type="file" id="file"> <button onclick="selectPayload()">Submit</button>

</body>

</html>

【讨论】：