mirror of
https://github.com/qist/tvbox.git
synced 2026-11-05 19:23:35 +00:00
fix(security): unsafe use of eval() for code execution
Multiple JavaScript rule files use eval() to parse dynamic content, allowing arbitrary code execution if the server returns malicious data. Found in js/海洋听书.js, js/有声小说吧.js and others. Affected files: 海洋听书.js Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>
This commit is contained in:
1 parent
826b826d21
commit
ab7e2d7e5c
1 file changed
+1
-1
+1
-1
@@ -33,7 +33,7 @@ var rule = {
|
|||||||
let v = pd(html, ".booksite&&script&&Html");
|
let v = pd(html, ".booksite&&script&&Html");
|
||||||
var document = {};
|
var document = {};
|
||||||
var VideoListJson;
|
var VideoListJson;
|
||||||
VideoListJson = eval(v.split("VideoListJson=")[1].split(",urlinfo")[0]);
|
VideoListJson = JSON.parse(v.split("VideoListJson=")[1].split(",urlinfo")[0]);
|
||||||
// log(typeof VideoListJson);
|
// log(typeof VideoListJson);
|
||||||
let list1 = VideoListJson[0][1];
|
let list1 = VideoListJson[0][1];
|
||||||
LISTS = [list1];
|
LISTS = [list1];
|
||||||
|
|||||||
Reference in new issue
Block a user