Jinja2 2.0 /utils.py urlize vulnerability

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

For Existing Member Sign In

› Authy

› Dashlane 密码管理器

This topic created in 4203 days ago, the information mentioned may be changed or developed.

关于v2ex的这几个跨站漏洞，问题出现在Jinja2的模版引擎，其中/utils.py urlize处理不当导致漏洞产生，新版本不存在此漏洞。

http://weibo.com/3274966043/Bu6ZnAWo1
http://www.hackersoul.com/post/jinja2_2_0_urlize_vulnerability.html

4 replies • 2015-12-11 13:49:45 +08:00

Evi1m0

Oct 31, 2014

@Livid here :)

fucker

Oct 31, 2014

mark

Livid

MOD

PRO

Nov 1, 2014

:)

赞！

Evi1m0

Dec 11, 2015