xss_dom_x.php+号被解码成空格 导致加号无法使用

[lushanshan1995]

源码 function domxss(){ var str = window.location.search; var txss = decodeURIComponent(str.split("text=")[1]); var xss = txss.replace(/+/g,' '); // alert(xss);

                    document.getElementById("dom").innerHTML = "<a href='"+xss+"'>就让往事都随风,都随风吧</a>";
                }

Bug: 当前decodeURIComponent和replace的实现顺序会将“+”和“%2B”都解码为空格

decodeURIComponent("x%2By+z").replace(/+/g, ' ') < "x y z"

decodeURIComponent("x%2By+z".replace(/+/g, ' ')) < "x+y z"

[lushanshan1995]

导致我用+拼接cookie 拼了两个小时0.0