【发布时间】:2015-01-14 13:05:35
【问题描述】:
我正在使用下面的代码在a 上添加一个select 类,该类有一个与地址栏中的字符串匹配的id。但我还需要 abe 更改 dropdown-toggle 的文本以匹配相同的字符串。
var string = document.location.href.split('=')[1];
if ($('li a[id^="filter-"][id*="' + string + '"]').length){
$('li a[id^="filter-"][id*="' + string + '"]').addClass('selected');
}
var text = $("li a.selected").html();
var htmlText = text + ' <span class="caret"></span>';
$('.dropdown-toggle').html(htmlText);
以上代码将.dropdown-toggle的文字改为:
undefined
它应该改为
Ogilvy
完整的网址是:
http://www.example.com/xchanges/#comboFilters%5BAgencies%5D=.Ogilvy&comboFilters%5BClients%5D=.Vodafone
html
<ul id="filters" class="nav navbar-nav navbar-right">
<li class="option-combo dropdown Agency">
<a class="btn btn-default btn-lg dropdown-toggle" data-toggle="dropdown" href="#" role="button" aria-expanded="false">.Ogilvy&comboFilters%5BClients%5D <span class="caret"></span></a>
<ul class="filter option-set dropdown-menu" role="menu" aria-labelledby="dropdownMenu1" data-filter-group="Agencies">
<li><a class="btn btn-default btn-lg" href="#" data-filter-value="">All agencies</a></li>
<li><a id="filter-TBWA" class="btn btn-default btn-lg" href="#filter-agency-TBWA" data-filter-value=".TBWA">TBWA</a></li>
<li><a id="filter-Ogilvy" class="btn btn-default btn-lg selected" href="#filter-agency-Ogilvy" data-filter-value=".Ogilvy">Ogilvy</a></li>
</ul>
</li>
<li class="option-combo dropdown Client">
<a class="btn btn-default btn-lg dropdown-toggle" data-toggle="dropdown" href="#" role="button" aria-expanded="false">.Ogilvy&comboFilters%5BClients%5D <span class="caret"></span></a>
<ul class="filter option-set dropdown-menu" role="menu" aria-labelledby="dropdownMenu2" data-filter-group="Clients">
<li><a class="btn btn-default btn-lg" ref="#" data-filter-value="">All clients</a></li>
<li><a id="filter-Sky" class="btn btn-default btn-lg" href="#filter-client-Sky" data-filter-value=".Sky">Sky</a></li>
<li><a id="filter-Vodafone" class="btn btn-default btn-lg selected" href="#filter-client-Vodafone" data-filter-value=".Vodafone">Vodafone</a></li>
</ul>
</li>
<li class="option-combo dropdown Year">
<a class="btn btn-default btn-lg dropdown-toggle" data-toggle="dropdown" href="#" role="button" aria-expanded="false">.Ogilvy&comboFilters%5BClients%5D <span class="caret"></span></a>
<ul class="filter option-set dropdown-menu" role="menu" aria-labelledby="dropdownMenu2" data-filter-group="Years">
<li><a class="btn btn-default btn-lg" ref="#" data-filter-value="">All years</a></li>
<li><a id="filter-y2013" class="btn btn-default btn-lg" href="#filter-year-y2013" data-filter-value=".y2013">2013</a></li>
<li><a id="filter-y2014" class="btn btn-default btn-lg" href="#filter-year-y2014" data-filter-value=".y2014">2014</a></li>
<li><a id="filter-y2012" class="btn btn-default btn-lg" href="#filter-year-y2012" data-filter-value=".y2012">2012</a></li>
</ul>
</li>
<li><button class="btn btn-default btn-lg no-bkg" id="open-button">About</button></li>
</ul>
【问题讨论】:
-
在我看来,您的代码很容易受到 XSS 攻击。根据未经处理的用户输入显示代码库确实可能导致不同类型的滥用......
-
我根据未经处理的用户输入显示什么代码?
-
我是通过客户端而不是服务器端来填充的,应该没问题吧?
-
您从查询字符串中获取字符串,并通过您提供的代码的前 3 行立即将其注入您的 HTML。因此,基本上可以生成指向您的网站但执行远程托管的恶意 javascript 的恶意 URL。或者我错过了什么,但我很确定我说的是什么。
-
我认为这与服务器端有关,而不是客户端
标签: jquery