Javascript 我用sockets.io创建了一个简单的聊天室,如何防止XSS攻击?
正如标题所说,我用sockets.io创建了一个简单的聊天室,唯一的问题是我没有xss保护,我的朋友们一直把无限循环作为用户名,所以你可以想象这是如何得到trolly:p。这是我的app.jsJavascript 我用sockets.io创建了一个简单的聊天室,如何防止XSS攻击?,javascript,node.js,socket.io,Javascript,Node.js,Socket.io,正如标题所说,我用sockets.io创建了一个简单的聊天室,唯一的问题是我没有xss保护,我的朋友们一直把无限循环作为用户名,所以你可以想象这是如何得到trolly:p。这是我的app.js /** * Module dependencies. */ var express = require('express') , routes = require('./routes') , user = require('./routes/user') , http = require
/**
* Module dependencies.
*/
var express = require('express')
, routes = require('./routes')
, user = require('./routes/user')
, http = require('http')
, path = require('path');
var app = express();
// all environments
app.set('port', process.env.PORT || 3000);
app.set('views', __dirname + '/views');
app.set('view engine', 'jade');
app.use(express.favicon());
app.use(express.logger('dev'));
app.use(express.bodyParser());
app.use(express.methodOverride());
app.use(app.router);
app.use(express.static(path.join(__dirname, 'public')));
// development only
if ('development' == app.get('env')) {
app.use(express.errorHandler());
}
app.get('/', routes.index);
app.get('/users', user.list);
var server = http.createServer(app).listen(app.get('port'), function(){
console.log('Express server listening on port ' + app.get('port'));
});
var io = require('socket.io').listen(server);
var usernames = {};
io.sockets.on('connection', function (socket) {
// When the client emits 'sendchat' this listens and executes
socket.on('sendchat', function(data) {
io.sockets.emit('updatechat', socket.username, data);
});
// When the client emites 'adduser' this listens and executes
socket.on('adduser', function(username) {
// Store the username in the socket session for this client
socket.username = username;
// add the client's username to the global list
usernames[username] = username;
// echo to the client they've connected
socket.emit('updatechat', 'SERVER', 'you have connected');
// echo globally (all clients) that a person has connected
socket.broadcast.emit('updatechat', 'SERVER', username + ' has connected');
// update the list of users in chat, client-side
io.sockets.emit('updateusers', usernames);
});
socket.on('disconnect', function() {
// remove the username from global usernames list
delete usernames[socket.username];
// update list of users in chat, client-side
io.sockets.emit('updateusers', usernames);
// echo globally that the client has left
socket.broadcast.emit('updatechat', 'SERVER', socket.username + ' has disconnected');
});
});
我怎样才能清理他们的输入以防止这些事情发生,我试着用谷歌搜索XSS保护预防、清理html输入和其他事情,但我什么也找不到
客户端代码:
socket.on('updatechat', function(username, data) {
$('#conversation').append('<b>'+username+ ':</b>' + data.replace() + '<br>');
});
socket.on('updatechat',函数(用户名、数据){
$(“#对话”).append(“+username+”:“+data.replace()+”
”);
});
正如我在评论中提到的,不要从服务器发送整个消息。您正在浪费带宽,并将表示层混入服务器,这将使以后的事情变得非常麻烦
不要使用此updatechat
emit,而是尝试使用用户名发送一些更有用的内容,例如userDisconnected
。让客户端代码显示客户端已断开连接的消息
现在,对于您的客户,请执行以下操作:
socket.on('userDisconnected', function(username, data) {
$('#conversation').append(
$('<span>').addClass('serverMessage').text(username + ' has disconnected'),
);
});
socket.on('userDisconnected',函数(用户名、数据){
$(“#对话”)。追加(
$('').addClass('serverMessage').text(用户名+'已断开连接),
);
});
这里的关键是使用
$.text()
设置内部文本。HTML变得无关紧要。扔掉你的updatechat
emit并发送数据。将该数据的显示留给客户机。在客户端,设置元素的innerText。。。不要盲目地把这些东西放在HTML中。@Brad我该怎么处理呢?谢谢工作得很好:D-对sockets来说是新的,我不知道它能像那样直接显示给DOM