采用富文本编辑器，潜在危险问题

最新推荐文章于 2024-06-29 11:07:23 发布

john_bh

最新推荐文章于 2024-06-29 11:07:23 发布

阅读量2.3k

点赞数 1

分类专栏： C#笔记随笔

本文链接：https://blog.csdn.net/john_bh/article/details/54020851

版权

C#笔记随笔专栏收录该内容

17 篇文章 0 订阅

订阅专栏

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="CKEditorDemo.aspx.cs" Inherits="BookShop.Web.Test.CKEditorDemo" %>

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
    <title></title>
    <script src="../ckeditor/ckeditor.js"></script>
</head>
<body>
    <form id="form1" runat="server">
    <div>
    <textarea cols="100" rows="10" id ="editor1" name ="editor1"></textarea>
        <script type="text/javascript">
            var editor = CKEDITOR.replace("editor1");
        </script>
        <input type="submit" value="提交" />
    </div>
    </form>
</body>
</html>

这就是---跨站脚本攻击

方法：

查看微软文档，

1.在web.config文件中添加：

<httpRuntime requestValidationMode="2.0" />

2.在page中，添加：

validateRequest="false"

出于安全考虑，富文本编辑器只是用在网站后台信息的编辑

用UBB编辑器

//加载UBB编辑器
        function loadUBBCode() {
            CKEDITOR.replace('txtContent',
	{
	    extraPlugins: 'bbcode',
	    removePlugins: 'bidi,button,dialogadvtab,div,filebrowser,flash,format,forms,horizontalrule,iframe,indent,justify,liststyle,pagebreak,showborders,stylescombo,table,tabletools,templates',
	    toolbar:
		[
			['Source', '-', 'Save', 'NewPage', '-', 'Undo', 'Redo'],
			['Find', 'Replace', '-', 'SelectAll', 'RemoveFormat'],
			['Link', 'Unlink', 'Image'],
			'/',
			['FontSize', 'Bold', 'Italic', 'Underline'],
			['NumberedList', 'BulletedList', '-', 'Blockquote'],
			['TextColor', '-', 'Smiley', 'SpecialChar', '-', 'Maximize']
		],
	    smiley_images:
		[
			'regular_smile.gif', 'sad_smile.gif', 'wink_smile.gif', 'teeth_smile.gif', 'tounge_smile.gif',
			'embaressed_smile.gif', 'omg_smile.gif', 'whatchutalkingabout_smile.gif', 'angel_smile.gif', 'shades_smile.gif',
			'cry_smile.gif', 'kiss.gif'
		],
	    smiley_descriptions:
		[
			'smiley', 'sad', 'wink', 'laugh', 'cheeky', 'blush', 'surprise',
			'indecision', 'angel', 'cool', 'crying', 'kiss'
		]
	});
        }

用正则表达式将其替换:

/// <summary>
        /// 将UBB编码转成HTML编码
        /// </summary>
        /// <param name="argString"></param>
        /// <returns></returns>
        public static string UbbToHtml(string argString)
        {
            string tString = argString;
            if (tString != "")
            {
                Regex tRegex;
                bool tState = true;
                tString = tString.Replace("&", "&");
                tString = tString.Replace(">", ">");
                tString = tString.Replace("<", "<");
                tString = tString.Replace("\"", """);
                tString = Regex.Replace(tString, @"\[br\]", "<br />", RegexOptions.IgnoreCase);
                string[,] tRegexAry = {
          {@"\[p\]([^\[]*?)\[\/p\]", "$1<br />"},
          {@"\[b\]([^\[]*?)\[\/b\]", "<b>$1</b>"},
          {@"\[i\]([^\[]*?)\[\/i\]", "<i>$1</i>"},
          {@"\[u\]([^\[]*?)\[\/u\]", "<u>$1</u>"},
          {@"\[ol\]([^\[]*?)\[\/ol\]", "<ol>$1</ol>"},
          {@"\[ul\]([^\[]*?)\[\/ul\]", "<ul>$1</ul>"},
          {@"\[li\]([^\[]*?)\[\/li\]", "<li>$1</li>"},
          {@"\[code\]([^\[]*?)\[\/code\]", "<div class=\"ubb_code\">$1</div>"},
          {@"\[quote\]([^\[]*?)\[\/quote\]", "<div class=\"ubb_quote\">$1</div>"},
          {@"\[color=([^\]]*)\]([^\[]*?)\[\/color\]", "<font style=\"color: $1\">$2</font>"},
          {@"\[hilitecolor=([^\]]*)\]([^\[]*?)\[\/hilitecolor\]", "<font style=\"background-color: $1\">$2</font>"},
          {@"\[align=([^\]]*)\]([^\[]*?)\[\/align\]", "<div style=\"text-align: $1\">$2</div>"},
          {@"\[url=([^\]]*)\]([^\[]*?)\[\/url\]", "<a href=\"$1\">$2</a>"},
          {@"\[img\]([^\[]*?)\[\/img\]", "<img src=\"$1\" />"}
        };
                while (tState)
                {
                    tState = false;
                    for (int ti = 0; ti < tRegexAry.GetLength(0); ti++)
                    {
                        tRegex = new Regex(tRegexAry[ti, 0], RegexOptions.IgnoreCase);
                        if (tRegex.Match(tString).Success)
                        {
                            tState = true;
                            tString = Regex.Replace(tString, tRegexAry[ti, 0], tRegexAry[ti, 1], RegexOptions.IgnoreCase);
                        }
                    }
                }
            }
            return tString;
        }