Skip to content

Commit

Permalink
修正 $key 未编码
Browse files Browse the repository at this point in the history
修正异常页面的 XSS 漏洞
```http
GET http://127.0.0.1:8080/?%3Cscript%3Eeval(atob(`YWxlcnQoJzEyMycp`))%3C/script%3E=1
```

```php
<?php

namespace app\controller;

class Index
{
    public function index(array $params)
    {
    }
}
```
  • Loading branch information
big-dream authored and liu21st committed Apr 11, 2024
1 parent aa334db commit 403358c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/tpl/think_exception.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ if (!function_exists('parse_args')) {
break;
}

$result[] = is_int($key) ? $value : "'{$key}' => {$value}";
$result[] = is_int($key) ? $value : sprintf('\'%s\' => %s', htmlentities($key), $value);
}

return implode(', ', $result);
Expand Down

0 comments on commit 403358c

Please sign in to comment.