没尾巴的鲸鱼_
Lv.1
测试CodemaoAPI
获赞:252收藏:41浏览:3086作品收藏:20
Lv.1
测试CodemaoAPI
在 血 衣 的 血 泪 史 中回复
什么css注入，喵的，CSS，层叠样式表，用来管理网站页面布局，就比如说按钮的样式、颜色，文字边框，css是管页面布局的，关服务器什莫事，不信你们去问度娘
2020-12-27T20:17:19 点赞:0
在 每日一个岛3建图小技巧：满足一定人数后，Game on！ 中回复
imgsrc="https://static.codemao.cn/emoji/codemao/%E7%BC%96%E7%A8%8B%E7%8C%AB_%E6%88%91%E9%94%99%E4%BA%86.gif"alt="emotion_编程猫_我错了"
2022-05-22T12:19:02 点赞:0
在 整活帖：NomenSandbox-Nomen沙盒，为不受信任的代码提供安全的运行空间 中回复
只要添加3个config项，添加一下这个对象代理替换代码就可以解决constructor的问题（
if (this.constructorVisit) {
for (el in this.permision) {
this.permision[el] = new Proxy(this.permision[el], {
get(target, key) {
if (target[key] == target.constructor) { return undefined };
if (r.bannedGet[el].includes(key)) { return undefined };
return target[key];
},
set(target, key, val) {
if (target[key] == target.constructor) { return undefined };
if (r.bannedSet[el].includes(key)) { return undefined };
target[key] = val;
}
})
}
}2023-05-15T21:31:19 点赞:0
在 整活帖：NomenSandbox-Nomen沙盒，为不受信任的代码提供安全的运行空间 中回复
弄门🚪，我给沙盒执行提供的接口对象装上了代理，自带防构造器攻击，可以做到隔离特定成员，但while喵循环执行超时咋解决啊，是object有方法监听循环入口事件吗？
class SwingSandbox {
constructor(config, _code) {
this.timeout = config.timeout || 10 * 1000;
this.permision = config.permission || {};
this.constructorVisit = config.constructorVisit || false;
this.bannedSet = config.bannedSet || {};
this.bannedGet = config.bannedGet || {};
this.finish = false;
this._cancel = false;
this.pgm = `try {
return (async () => {
let __st = setTimeout(() => {
if (sandbox.__finish__) { clearTimeout(__st); return; }
sandbox.__complete(new Error('[SwingSandbox] Sandbox Execute Timeout'));
throw new Error('[SwingSandbox] Sandbox Execute Timeout');
}, ${this.timeout});
with (sandbox) {
(async () => { return await ${(typeof _code == "function") ? '(' + _code.toString() + ')()' : _code} })()
.then(v => __complete(v))
.catch(e => __complete('[SwingSandbox: Error When execute user script]'+e))
.finally(() => __finish__ = true)
};
})()
} catch (err) { __complete('[SwingSandbox: Error When Runing SwingSandbox]'+err) }`;
}
__run__() {
if (this.finish) return;
return (async () => {
let r = this;
Object.assign(this.permision, {
get __finish__() { return r.finish || r._cancel },
r,
setInterval,
clearInterval,
setTimeout,
clearTimeout,
Error,
Promise,
})
if (this.constructorVisit) {
for (el in this.permision) {
this.permision[el] = new Proxy(this.permision[el], {
get(target, key) {
if (target[key] == target.constructor) { return undefined };
if (r.bannedGet[el].includes(key)) { return undefined };
return target[key];
},
set(target, key, val) {
if (target[key] == target.constructor) { return undefined };
if (r.bannedSet[el].includes(key)) { return undefined };
target[key] = val;
}
})
}
}
try {
let result = await new Promise(resolve => {
r.permision.__complete = (v) => resolve(v)
const sandbox = new Proxy(r.permision, {
has() { return true },
get(target, key) { return (key == Symbol.unscopables) ? undefined : target[key] }
});
const cd = new Function('sandbox', r.pgm);
cd(sandbox)
.then(v => {
this.finish = true;
}).catch(e => { })
});
return result
} catch (err) {
return err;
}
})()
}
}2023-05-15T21:56:04 点赞:0