mirror of
https://github.com/qist/tvbox.git
synced 2026-11-04 18:53:24 +00:00
fix(security): unsafe use of eval() for code execution
Multiple JavaScript rule files use eval() to parse dynamic content, allowing arbitrary code execution if the server returns malicious data. Found in js/海洋听书.js, js/有声小说吧.js and others. Affected files: 海洋听书.js Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>
This commit is contained in:
1 parent
826b826d21
commit
ab7e2d7e5c
1 file changed
+1
-1
+1
-1
@@ -33,7 +33,7 @@ var rule = {
|
||||
let v = pd(html, ".booksite&&script&&Html");
|
||||
var document = {};
|
||||
var VideoListJson;
|
||||
VideoListJson = eval(v.split("VideoListJson=")[1].split(",urlinfo")[0]);
|
||||
VideoListJson = JSON.parse(v.split("VideoListJson=")[1].split(",urlinfo")[0]);
|
||||
// log(typeof VideoListJson);
|
||||
let list1 = VideoListJson[0][1];
|
||||
LISTS = [list1];
|
||||
|
||||
Reference in new issue
Block a user