Google漏洞过滤规则研究

1、通过Protobuf的代码发现了过滤逻辑

goog.string.AMP_RE_ = /&/g;
goog.string.LT_RE_ = /</g;
goog.string.GT_RE_ = />/g;
goog.string.QUOT_RE_ = /"/g;
goog.string.SINGLE_QUOTE_RE_ = /'/g;
goog.string.NULL_RE_ = /\x00/g;
goog.string.E_RE_ = /e/g;
goog.string.ALL_RE_ = goog.string.DETECT_DOUBLE_ESCAPING ? /[\x00&<>"'e]/ : /[\x00&<>"']/;

goog.string.htmlEscape = function(str, opt_isLikelyToContainHtmlChars) {
  if (opt_isLikelyToContainHtmlChars) {
    str = str.replace(goog.string.AMP_RE_, "&").replace(goog.string.LT_RE_, "<").replace(goog.string.GT_RE_, ">").replace(goog.string.QUOT_RE_, """).replace(goog.string.SINGLE_QUOTE_RE_, "'").replace(goog.string.NULL_RE_, "�"), goog.string.DETECT_DOUBLE_ESCAPING && (str = str.replace(goog.string.E_RE_, "e"));
  } else {
    if (!goog.string.ALL_RE_.test(str)) {
      return str;
    }
    -1 != str.indexOf("&") && (str = str.replace(goog.string.AMP_RE_, "&"));
    -1 != str.indexOf("<") && (str = str.replace(goog.string.LT_RE_, "&lt;"));
    -1 != str.indexOf(">") && (str = str.replace(goog.string.GT_RE_, "&gt;"));
    -1 != str.indexOf('"') && (str = str.replace(goog.string.QUOT_RE_, "&quot;"));
    -1 != str.indexOf("'") && (str = str.replace(goog.string.SINGLE_QUOTE_RE_, "&#39;"));
    -1 != str.indexOf("\x00") && (str = str.replace(goog.string.NULL_RE_, "&#0;"));
    goog.string.DETECT_DOUBLE_ESCAPING && -1 != str.indexOf("e") && (str = str.replace(goog.string.E_RE_, "&#101;"));
  }
  return str;
};

2、过滤一些特殊字符

oog.string.specialEscapeChars_ = {"\x00":"\\0", "\b":"\\b", "\f":"\\f", "\n":"\\n", "\r":"\\r", "\t":"\\t", "\x0B":"\\x0B", '"':'\\"', "\\":"\\\\", "<":"<"};

goog.string.jsEscapeCache_ = {"'":"\\'"};

" >>>>>> \"

3、 URLENCODE

对URL中一些请求进行服务端URLENCODE后输出；

4、HTML过滤

    f.string.Sj = function(a, c) {
        if (c) a = a.replace(f.string.IG, "&").replace(f.string.GH, "<").replace(f.string.DH, ">").replace(f.string.ZH, """).replace(f.string.cI, "'").replace(f.string.NH, "�"), f.string.Gy && (a = a.replace(f.string.AH, "e"));
        else {
            if (!f.string.SU.test(a)) return a; - 1 != a.indexOf("&") && (a = a.replace(f.string.IG, "&amp;")); - 1 != a.indexOf("<") && (a = a.replace(f.string.GH, "&lt;")); - 1 != a.indexOf(">") && (a = a.replace(f.string.DH, "&gt;")); - 1 != a.indexOf('"') && (a = a.replace(f.string.ZH,
                "&quot;")); - 1 != a.indexOf("'") && (a = a.replace(f.string.cI, "&#39;")); - 1 != a.indexOf("\x00") && (a = a.replace(f.string.NH, "&#0;"));
            f.string.Gy && -1 != a.indexOf("e") && (a = a.replace(f.string.AH, "&#101;"))
        }
        return a
    };
    f.string.IG = /&/g;
    f.string.GH = /</g;
    f.string.DH = />/g;
    f.string.ZH = /"/g;
    f.string.cI = /'/g;
    f.string.NH = /\x00/g;
    f.string.AH = /e/g;
    f.string.SU = f.string.Gy ? /[\x00&<>"'e]/ : /[\x00&<>"']/;
    f.string.nG = function(a) {
        return f.string.contains(a, "&") ? !f.string.n0 && "document" in f.global ? f.string.gU(a) : f.string.Jka(a) : a
    };

5. 默认输出过滤

针对所有的输出进行过滤；