查看效果 guoshuangweb/coding/xlt/1.xml

代码如下：

1.xml

</p> <p><?xml version="1.0" encoding="UTF-8"?></p> <p><?xml-stylesheet type="text/xsl" href="1.xsl"?></p> <p><root></p> <p> <level-1></p> <p> <level-1-1></p> <p> <level-1-1-1/></p> <p> </level-1-1></p> <p> <level-1-2/></p> <p> </level-1></p> <p> <level-2></p> <p> <level-2-1></p> <p> </level-2-1></p> <p> <level-2-2></p> <p> <level-2-2-1/></p> <p> </level-2-2></p> <p> </level-2></p> <p></root></p> <p>

1.xsl

</p> <p><?xml version="1.0" encoding="UTF-8"?></p> <p><xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"></p> <p> <xsl:template match="/"></p> <p> <xsl:for-each select="//*"></p> <p> <xsl:value-of select="local-name()"/> ＝</p> <p> <xsl:value-of select="count(ancestor::*)"/></p> <p> <br/></p> <p> </xsl:for-each></p> <p> </xsl:template></p> <p></xsl:stylesheet></p> <p>

Description:

Details have been released about several vulnerabilities in Mozilla, Mozilla Firefox, and Thunderbird. These can potentially be exploited by malicious people to conduct cross-site scripting attacks, access and modify sensitive information, and compromise a user’s system.

1) Various boundary errors in “nsMsgCompUtils.cpp” can be exploited to cause heap-based buffer overflows when a specially crafted e-mail is forwarded.

Successful exploitation can potentially lead to execution of arbitrary code.

2) Insufficient restrictions on script generated events on text fields can be exploited to read and write content from and to the clipboard.

3) Boundary errors in the “writeGroup()” function in “nsVCardObj.cpp” can be exploited to cause stack-based buffer overflows by sending an e-mail containing a specially crafted vcard.

Successful exploitation may allow execution of arbitrary code but requires that the malicious e-mail is opened in preview.

4) Some boundary errors in “nsPop3Protocol.cpp”, which handles POP3 mail communication, can be exploited to cause buffer overflow by a malicious POP3 mail server when sending specially crafted responses.

Successful exploitation may potentially allow execution of arbitrary code.

5) A problem with overly long links containing a non-ASCII characters can be exploited via a malicious website or e-mail to cause a buffer overflow, which potentially can lead to execution of arbitrary code.

6) An integer overflows when parsing and displaying BMP files can potentially be exploited to execute arbitrary code by supplying an overly wide malicious BMP image via a malicious website or in an e-mail.

7) Mozilla allows dragging links to another window or frame. This can e.g be exploited by tricking a user on a malicious website to drag a specially crafted java script link to another window.

Successful exploitation can cause script code to execute in context of that window. Further exploitation can in combination with another unspecified vulnerability lead to execution of arbitrary code.

Signed scripts can request enhanced privileges, which requires that a user accepts a security dialog. The problem is that a malicious website can pass a specially crafted parameter making it possible to manipulate information displayed in the security dialog.

Successful exploitation allows a website to trick users into accepting security dialogs, which will grant access to run arbitrary programs.

9) Some files installed with the Linux installer are group and world writable. This can be exploited by malicious, local users to replace files, which can lead to execution of arbitrary code.

10) Many files and directories in the Linux install “.tar.gz” archives have wrong owner and permissions. This can be exploited by malicious, local users to replace files if the umask is set to be ignored when unpacking.

Successful exploitation can lead to execution of arbitrary code.

These vulnerabilities reportedly affect versions prior to the following:

- Mozilla 1.7.3

- Firefox 1.0PR

- Thunderbird 0.8

原文地址在：

http://secunia.com/advisories/12526/

</p> <style type="text/css"> <p>body {font:12px tahoma}</p> <p>#aBack {background-image:url(guoshuangweb/coding/bg.jpg);width:200px;}</p> <p>a {display:block;text-decoration:none;text-align:center;width:200px;height:30px;color:#000;line-height:30px;background-color:#eee;margin:3px;}</p> <p>a:hover {background-color:transparent;color:#fff;}</p> </style> <p><body></p> <div id="aBack"> <p><a href="##1">菜单一</a></p> <p><a href="##2">菜单二</a></p> <p><a href="##3">菜单三</a></p> <p><a href="##4">菜单四</a></p> </div> <p></body></p> <p> [Ctrl+A 全部选择 提示：你可先修改部分代码，再按运行]

ADO Connections

ADO Reference

XML Reference

Dynamic HTML Reference

JScript Language Reference

HTML Components (HTCs)

File System Object Model

DirectAnimation

Office 2000 Web Components

Office 2000 Web Components

VML Reference

Dreamweaver Extensibility Newsgroup

Dreamweaver Application Development

原文地址在：

http://myhyli.digichina.net/

myhyli是我的偶像，他的人品、技术都没得说。这是他做的一个小东西。

guoshuangweb/software/myhyli’s_outlook.rar

以下为引用内容:

---

软件功能：

1.接收POP3邮件

涉及技术：

1.hta(HTML Application)

这是主程序得以运行的环境

2.xml

本作品大多数配置信息、邮件内容都以XML方式保存

3.fso

主要用于删除文件

4.ado

用于保存文本、二进制文件，以及文本、二进制流的输入输出

5.quoted-printable 和 base64

邮件一般都是这两种方式进行编码传输的，这里用到了用js+xml+ado来实现解码的方法

6.asp.net的sockets类库

用于向pop3服务器建立一个tcp连接，并且通过networkStream向pop3服务器发送pop3命令和获取服务器返回信息(该源代码不包含在上述压缩包内，属于服务器端程序，需要的可以向我索取)

7.flash

主要用于向服务器发送提交信息，并获取服务器返回的文本信息，以及显示载入进度

软件特点：

1.邮件以xml方式保存，方便转换成用户需要的格式

2.支持自动更新(目前是通过点击右上角Update按钮来执行，目前我每天都会随时更新，大家只需要点击该按钮就可以和服务器上文件版本保持同步)

花了几乎一个星期才做到现在这个程度（当然不包括白天上班的时间），希望大家喜欢，欢迎进行技术讨论和提出宝贵意见，或BUG报告(随后我会在界面上加上该功能)

做这个作品最主要的目的还是磨练自己的技术，在开发过程中找到更好的编程实现方式

有什么问题尽管问啊~

---

原文地址在：

http://www.blueidea.com/bbs/newsdetail.asp?id=1752098&page=9999&daysprune=5&lp=1

标题：利用adodb.stream直接下载任何

签写人：renaski

在浏览器的地址栏里直接输入一个doc或xls或jpg的文件的url路径，那么该文件会直接显示在浏览器里。而在很多时候我们希望能直接弹出下载提示框让用户下载，我们该怎么办呢？这里有两种方法：

1、设置你的服务器的iis，给doc等后缀名做映射

2、在向客户端发送时设置其contenttype

下面详细说明方法2

<%

Response.Buffer = true

Response.Clear

dim url

Dim fso,fl,flsize

dim Dname

Dim objStream,ContentType,flName,isre,url1

'*********************************************调用时传入的下载文件名

Dname=trim(request("n"))

'******************************************************************

If Dname<>“” Then

‘******************************下载文件存放的服务端目录

url=server.MapPath(”/”)&”"&Dname

‘***************************************************

End If

Set fso=Server.CreateObject(”Scripting.FileSystemObject”)

Set fl=fso.getfile(url)

flsize=fl.size

flName=fl.name

Set fl=Nothing

Set fso=Nothing

%>

<%

Set objStream = Server.CreateObject("ADODB.Stream")

objStream.Open

objStream.Type = 1

objStream.LoadFromFile url

Select Case lcase(Right(flName, 4))

Case ".asf"

ContentType = "video/x-ms-asf"

Case ".avi"

ContentType = "video/avi"

Case ".doc"

ContentType = "application/msword"

Case ".zip"

ContentType = "application/zip"

Case ".xls"

ContentType = "application/vnd.ms-excel"

Case ".gif"

ContentType = "image/gif"

Case ".jpg", "jpeg"

ContentType = "image/jpeg"

Case ".wav"

ContentType = "audio/wav"

Case ".mp3"

ContentType = "audio/mpeg3"

Case ".mpg", "mpeg"

ContentType = "video/mpeg"

Case ".rtf"

ContentType = "application/rtf"

Case ".htm", "html"

ContentType = "text/html"

Case ".txt"

ContentType = "text/plain"

Case Else

ContentType = "application/octet-stream"

End Select

Response.AddHeader "Content-Disposition", "attachment; filename=" & flName

Response.AddHeader "Content-Length", flsize

Response.Charset = "UTF-8"

Response.ContentType = ContentType

Response.BinaryWrite objStream.Read

Response.Flush

response.Clear()

objStream.Close

Set objStream = Nothing

%>

将下面的东西存成download.asp然后你就可以用download!来下载同一目录下的file.doc了!

但是这里有个问题就是直接将file.doc路径写在url里是不安全的，所以解决方案应该是将file.doc的路径存到数据库里，同过查找数据库后得到路径

在这个程序的最前面如果加上一个判断：

if instr(Request.ServerVariables(”HTTP_REFERER”),”http://你的域名”)=0 then

Response.End

end if

就能够很好的防止别人的盗链了

原文地址在：

http://www.ywicc.com/webcoding/showlog.asp?cat_id=26&log_id=903