[JS] Base64 Decode

base64 디코드 이슈

function base64Decode(input){
	
	var keyStr ="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
	var output = "";
	var chr1, chr2, chr3;
	var enc1, enc2, enc3, enc4;
	var i = 0;

	input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");

	while (i < input.length) {

		enc1 = keyStr.indexOf(input.charAt(i++));
		enc2 = keyStr.indexOf(input.charAt(i++));
		enc3 = keyStr.indexOf(input.charAt(i++));
		enc4 = keyStr.indexOf(input.charAt(i++));

		chr1 = (enc1 << 2) | (enc2 >> 4);
		chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
		chr3 = ((enc3 & 3) << 6) | enc4;

		output = output + String.fromCharCode(chr1);

		if (enc3 != 64) {
			output = output + String.fromCharCode(chr2);
		}
		if (enc4 != 64) {
			output = output + String.fromCharCode(chr3);
		}

	}

	output = utf8_decode(output);

	return output;
}
function utf8_decode(utftext) {
	var string = "";
	var i = 0;
	var c = c1 = c2 = 0;

	while ( i < utftext.length ) {

		c = utftext.charCodeAt(i);

		if (c < 128) {
			string += String.fromCharCode(c);
			i++;
		}
		else if((c > 191) && (c < 224)) {
			c2 = utftext.charCodeAt(i+1);
			string += String.fromCharCode(((c & 31) << 6) | (c2 & 63));
			i += 2;
		}
		else {
			c2 = utftext.charCodeAt(i+1);
			c3 = utftext.charCodeAt(i+2);
			string += String.fromCharCode(((c & 15) << 12) | ((c2 & 63) << 6) | (c3 & 63));
			i += 3;
		}

	}
	return string;
}


var Request = function()
{
	this.getParameter = function( name )
	{
		var rtnval = "";
		var nowAddress = unescape(location.href);
		var parameters = (nowAddress.slice(nowAddress.indexOf("?")+1,nowAddress.length)).split("&");
 
		for(var i = 0 ; i < parameters.length ; i++)
		{
			var varName = parameters[i].split("=")[0];
			if(varName.toUpperCase() == name.toUpperCase())
			{
				rtnval = parameters[i].split("=")[1];
				break;
			}
		}
		return rtnval;
	}
}

var request = new Request();
var query = request.getParameter("query");

if( query != '' ){
	query = base64Decode(query);
	query = query.replace('<', '&lt;').replace('>', '&gt;');
	document.getElementById("query").innerHTML=query;
}

 

아래쪽에 query = query.replace('<', '&lt;').replace('>', '&gt;'); 
<svg onload="alert('XSS')"></svg> 로 문자열 던지면 얼럿이 노출되는 이슈가 있음.
태그 자체를 치환해야할 필요.