我希望这个漏洞能被记住：分析剪贴板事件监听器中的存储型XSS

1
2
3
4
5
6
7
8

private prepareData(t: DataTransfer | null): ReadData | undefined {
  if (!t) return;
  return {
    html: t.getData(MIME_TYPE.TEXT_HTML),
    text: t.getData(MIME_TYPE.TEXT_PLAIN),
    files: Array.from(t.files || []),
  };
}

1
2
3
4
5

document.addEventListener("paste", this.pasteListener);
...
private pasteListener = (evt: ClipboardEvent) => {
  this.pasteWrapper(this.prepareData(evt.clipboardData));
};

1
2
3

const dt = event.dataTransfer;
dt.setData("text/html", "Hello there, <strong>stranger</strong>");
dt.setData("text/plain", "Hello there, stranger");

1
2
3
4
5
6

private pasteWrapper = async (t?: ReadData) => {
  ...
  await this.read();
  ...
  await page.paste(position);
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

private async read() {
  let items: ClipboardItems = [];
  try {
    items = await navigator.clipboard.read();
  } catch (err) {
    SYSTEM_LOGGER.warn(err);
    return;
  }
  const target = items.pop();
  if (!target) return;
  const type = target.types[target.types.length - 1];
  if (!type) return;
  const b = await target.getType(type);
  ...
  if (type === MIME_TYPE.TEXT_PLAIN) {
    const t = await b.text();
    t && data.push(this.createTextBox(t));
  } else if (IMAGE_REGEXP.test(type)) {
    const ext = getBlobTypeExt(b);
    if (!ext) return;
    const f = new File([b], `image.${ext}`, { type });
    if (!this.uploadPermission(f)) return;
    const img = await this.createImage(f);
    img && data.push(img);
  } else if (type === MIME_TYPE.TEXT_HTML) {
    const zdcData = await getZDCCopyObjects(b);
    if (zdcData) {
      data.push(...zdcData.objs);
      zdcData.meta && this.updateMeta(zdcData.meta);
    } else {
      const t = getStringFromHtmlString(await b.text());
      t && data.push(this.createTextBox(t));
    }
  ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

private async createImage(file: File) {
  ...
  return {
    pageID: parseInt(page.id),
    id,
    wireType: WBObjType.WB_OBJ_TYPE_IMAGE,
    transform: [scale, 0, 0, scale, left, top],
    fileID,
    size: originSize,
    originalID: id,
  } as ZDCCopyObject;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

export async function getZDCCopyObjects(b: Blob) {
  if (b.type !== MIME_TYPE.TEXT_HTML) return;
  const t = await b.text();

  return getZDCCopyObjectsFromHtmlString(t);
}

export const ExtractCopy = /^<--\(zdc-data\)(.*)\(\/zdc-data\)-->$/;

export const CopyMeta = {
  tag: "span",
  meta: "data-meta",
};

export function getZDCCopyObjectsFromHtmlString(s: string) {
  try {
    const d = new DOMParser().parseFromString(s, MIME_TYPE.TEXT_HTML);
    const el = d.querySelector(`${CopyMeta.tag}[${CopyMeta.meta}]`);
    if (!el) return;
    const bta = el.getAttribute(CopyMeta.meta);
    if (!bta) return;
    const match = bta.match(ExtractCopy);
    if (!match || !match[1]) return;
    const { objs, meta } = JSON.parse(
      decodeURIComponent(window.atob(match[1]))
    ) as {
      objs: ZDCCopyObject[];
      meta?: ClipTargetMeta;
    };
    return Array.isArray(objs) ? { objs, meta } : undefined;
  } catch (err) {
    SYSTEM_LOGGER.warn(err);
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

export enum WBObjType {
  WB_OBJ_TYPE_UNKNOWN,
  WB_OBJ_TYPE_SHAPE,
  WB_OBJ_TYPE_LINE,
  WB_OBJ_TYPE_TEXT,
  WB_OBJ_TYPE_RICHTEXT,
  WB_OBJ_TYPE_GROUP,
  WB_OBJ_TYPE_SCRIBBLE,
  WB_OBJ_TYPE_STICKYNOTE,
  WB_OBJ_TYPE_IMAGE,
  WB_OBJ_TYPE_COMMENT,
}