XSS フィルターを解除するには X-XSS-Protection: 0
なんかプレビュー画面みたいなやつで、xss フィルターが反応してしまうので、
こまったものですね!
そういう場合には X-XSS-Protection: 0 をレスポンスヘッダにつけると、XSS フィルタを無効にできるのでいいです。
use strict;
use warnings;
use utf8;
use File::Spec;
use File::Basename;
use lib File::Spec->catdir(dirname(__FILE__), 'extlib', 'lib', 'perl5');
use lib File::Spec->catdir(dirname(__FILE__), 'lib');
use Amon2::Lite;
our $VERSION = '0.01';
# put your configuration here
sub load_config {
+{ }
}
any '/' => sub {
my $c = shift;
return $c->render('index.tt');
};
post '/d' => sub {
my $c = shift;
my $res = $c->render('d.tt', {
src => scalar($c->req->param('src'))
});
if ($c->req->param('noxss')) {
$res->header('X-XSS-Protection' => '0');
}
return $res;
};
__PACKAGE__->to_app(handle_static => 1);
__DATA__
@@ index.tt
<!doctype html>
<html>
<head>
<met charst="utf-8">
<title>XSS</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.0/jquery.min.js"></script>
<link rel="stylesheet" href="http://twitter.github.com/bootstrap/1.4.0/bootstrap.min.css">
<link rel="stylesheet" href="[% uri_for('/static/css/main.css') %]">
</head>
<body>
<div class="container">
<header><h1>XSS</h1></header>
<form method="post" action="/d">
<textarea name="src"><script>alert("It workss!");</script></textarea><br />
no xss: <input type="checkbox" name="noxss" /><br />
<input type="submit" value="post" class="btn" />
</form>
<section class="row">
This is a XSS
</section>
<footer>Powered by <a href="http://amon.64p.org/">Amon2::Lite</a></footer>
</div>
</body>
</html>
@@ /static/css/main.css
footer {
text-align: right;
}
@@ d.tt
<!doctype html>
<html>
<head>
<met charst="utf-8">
<title>XSS</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.0/jquery.min.js"></script>
<script type="text/javascript" src="[% uri_for('/static/js/main.js') %]"></script>
<link rel="stylesheet" href="http://twitter.github.com/bootstrap/1.4.0/bootstrap.min.css">
<link rel="stylesheet" href="[% uri_for('/static/css/main.css') %]">
</head>
<body>
<div class="container">
SRC: [% raw(src) %]
</div>
</body>
</html>
@@ /static/js/main.js
@@ /static/css/main.css
footer {
text-align: right;
}