由 david 共享
用css实现跨域ajax请求
Wes Biggs has posted on Xsstc, his cross-site scripting solution that uses CSS to hide the data:
It turns out CSS leaks data in a very subtle way. Properties set by an external stylesheet (that is, one that is loaded using a LINK REL="STYLESHEET" tag) are used to style the elements of the host page, and at runtime the page can introspect itself to see what styles have been applied. Most of these tend to be strictly prescribed data, such as background colours for block elements, or some multiple choice items, like left/center/right alignment for text. While you could conceivably come up with a binary (or ternary) system based on that, it would be a pretty nasty job to try to make those into a general-purpose data channel. Fortunately, there are a few places where CSS lets you specify essentially free-text attributes: image URLs.
To make this work, the server has to dynamically send out simple CSS data, with info encoded into it... e.g. note the 'Hello World'
-
-
#Xsstc {
-
background-image: url('about:blank#Hello%20World');
-
}
-
To tie into the data, you just need to exec away via:
-
-
Xsstc.exec('http://lbs.tralfamadore.com/test.css', showResponse)
-
You can see the test page to see it at work. An interesting hole indeed....
微笑图书馆
