mirror of
https://github.com/wll8/lodash-utils
synced 2024-11-14 11:56:23 +00:00
feat: 添加防范示例
This commit is contained in:
parent
b767004daa
commit
a6f57c7301
23
README.md
23
README.md
@ -1,7 +1,7 @@
|
||||
# lodash-utils
|
||||
引入之后, 就能像 lodash 一样工作,但是会在特定条件下产生一些错误。
|
||||
|
||||
此代码来自 [network](https://github.com/duo001/evil.js/network/members),当前用于检验安全测试中原型链被污染时的工作情况。
|
||||
此代码来自 [network](https://github.com/duo001/evil.js/network/members),用于验证和防止原型链被污染。
|
||||
|
||||
> 郑重声明:
|
||||
如果将此代码放在项目中,可能会使项目无法按预期工作,因此,
|
||||
@ -34,10 +34,31 @@ console.log(`newObj`, newObj)
|
||||
* `localStorage.getItem` 有5%几率返回空字符串。
|
||||
* `Math.random()` 的取值范围改为`0`到`1.1`
|
||||
|
||||
**防范示例**
|
||||
``` js
|
||||
|
||||
// 冻结 prototype
|
||||
;[
|
||||
Promise,
|
||||
Date,
|
||||
Array,
|
||||
].forEach(item => {
|
||||
Object.freeze(item[`prototype`]);
|
||||
})
|
||||
|
||||
// 测试拦截情况
|
||||
if(Array.prototype.includes.toString().includes(`native code`)) {
|
||||
console.log(`恶意代码被拦截`)
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
**声明:请勿用于任何项目!如果导致任何问题,与本人无关。**
|
||||
|
||||
---
|
||||
Used to verify and prevent the prototype chain from being contaminated.
|
||||
|
||||
Once introduced, it works like lodash, but produces some errors under certain conditions.
|
||||
|
||||
> Solemnly declare:
|
||||
If you place this code in your project, it may make the project not work as expected, so,
|
||||
|
Loading…
Reference in New Issue
Block a user