# Regex过滤器转义

``````function safeFunc(str) {
if (str.replace(/(?:\d+\.?\d*(?:e\d+)?)| /g, '')) {
return null;
}
return eval(str);
}
``````

### 解决方案：

EDIT 2答复：自本答复发布后，问题已被更改。原问题中的regex是 `/(?:Math(?:\.\w+)?)|[()+\-*/&|^%<>=,?:]|(?:\d+\.?\d*(?:e\d+)?)| /g`.

``````Math=Math.toString(),Math=Math.constructor,Math.code=Math.fromCharCode(97)+Math.fromCharCode(108)+Math.fromCharCode(101)+Math.fromCharCode(114)+Math.fromCharCode(116)+Math.fromCharCode(40)+Math.fromCharCode(49)+Math.fromCharCode(41),Math.constructor(Math.code)()
``````

EDIT: @Niet 黑暗的Absol 提醒了我 `String.fromCharCode` 可简化为：

``````Math=Math.toString(),Math=Math.constructor,Math.code=Math.fromCharCode(97,108,101,114,116,40,49,41),Math.constructor(Math.code)()
``````

1. `Math = Math.toString()` – 获取一个String实例。
2. `Math = Math.constructor` – 得到 `String` 功能，从而 `Math === String`;
3. `Math.code = Math.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)` – 通过以下方式获取代码字符串（即 `'alert(1)'`)，方法是 `String.fromCharCode()`你可以用你想注入的代码来代替它。
4. `Math.constructor(Math.code)()``Math.constructor``Function`，从而执行 `Function('alert(1)')()`.

2022-9-9 2:23:21

2022-9-9 2:23:23

0 条回复 A文章作者 M管理员
暂无讨论，说说你的看法吧
{"ft_lang_label":"__label__zh","ft_lang_prob":0.56887656,"math_prob":0.9874377,"size":1226,"snap":"2022-40-2023-06","text_gpt3_token_len":563,"char_repetition_ratio":0.2299509,"word_repetition_ratio":0.0,"special_character_ratio":0.32463294,"punctuation_ratio":0.32388663,"nsfw_num_words":0,"has_unicode_error":false,"math_prob_llama3":0.99691576,"pos_list":[0],"im_url_duplicate_count":[null],"WARC_HEADER":"{\"WARC-Type\":\"response\",\"WARC-Date\":\"2022-10-05T21:19:15Z\",\"WARC-Record-ID\":\"<urn:uuid:f135dca0-8778-47b9-94e3-859c76cc7472>\",\"Content-Length\":\"163879\",\"Content-Type\":\"application/http; msgtype=response\",\"WARC-Warcinfo-ID\":\"<urn:uuid:af754474-292e-4008-906d-808bcf18ac01>\",\"WARC-Concurrent-To\":\"<urn:uuid:9b0c75b3-6646-4011-963b-a6eb5c1da201>\",\"WARC-IP-Address\":\"82.157.122.194\",\"WARC-Target-URI\":\"https://www.shizhanbaodian.com/1753.html\",\"WARC-Payload-Digest\":\"sha1:E27EJ7GYURXL7IT65V2OR4JLZLKBQLPL\",\"WARC-Block-Digest\":\"sha1:JJV72QZXF5OHSRFUHAQ5MJ5MLVU7ECPZ\",\"WARC-Identified-Payload-Type\":\"text/html\",\"warc_filename\":\"/cc_download/warc_2022/CC-MAIN-2022-40/CC-MAIN-2022-40_segments_1664030337668.62_warc_CC-MAIN-20221005203530-20221005233530-00563.warc.gz\"}"}