<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[hanbb1982的专栏]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/hanbb1982</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; hanbb1982]]></copyright><item><title><![CDATA[微信支付XXE漏洞修复]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/82797720</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/82797720</guid><author>hanbb1982</author><pubDate>Fri, 21 Sep 2018 10:32:06 +0800</pubDate><description><![CDATA[1.场景还原



2.原因分析

所谓的外部实体注入漏洞，主要是在xml转map的时候处理不得当造成的，所以接下来的修复工作主要在xml解析类中下功夫

3.实现方案

由于我们用的是.net的开发环境。所以在原有解析xml的代码上添加一句就可以


XmlDocument xmlDoc = new XmlDocument();
           
            xmlDoc.Lo...]]></description><category></category></item><item><title><![CDATA[web下vs2008+crystal report 不预览直接打印]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/4938972</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/4938972</guid><author>hanbb1982</author><pubDate>Fri, 04 Dec 2009 11:37:00 +0800</pubDate><description><![CDATA[下载了一个PrintControl.cab（vs2008用的）然后在webconfig中设置： 代码 Code highlighting produced by Actipro CodeHighlighter (freeware)http://www.CodeHighlighter.com/--> 1  configSections> 2     sectionGroup name]]></description><category></category></item><item><title><![CDATA[用ObjectDataSource作数据源，用GridView分页时，获取总记录数的方法]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/1401507</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/1401507</guid><author>hanbb1982</author><pubDate>Tue, 21 Nov 2006 14:06:00 +0800</pubDate><description><![CDATA[GridView.rows.Count，返回的是GridView当前页面的记录数objectdatasource的selected事件，:e.AffectedRows返回-1解决办法：在ObjectDataSource的Selected事件，取e.ReturnValue的类型，强制转换类型取这个DataView的行数    Protected Sub ObjectDataSourc]]></description><category></category></item><item><title><![CDATA[ 如何用OWC制作双轴的折线图]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/744140</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/744140</guid><author>hanbb1982</author><pubDate>Thu, 18 May 2006 15:44:00 +0800</pubDate><description><![CDATA[对于第二个ChSeries进行Ungroup ThisChSeries.Ungroup(True) 生成一个新的坐标轴 thisAxis = owcChart.Axes.Add(ThisChSeries.Scalings(Owc11.ChartDimensionsEnum.chDimValues)) 定义格式，默认为空字串 thisAxis.NumberFormat = ]]></description><category></category></item><item><title><![CDATA[ASP.NET 2.0构建动态导航的Web应用程序（TreeView和Menu ]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/581712</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/581712</guid><author>hanbb1982</author><pubDate>Tue, 17 Jan 2006 11:31:00 +0800</pubDate><description><![CDATA[TreeView 控件关键属性CheckedNodes                 声明被选择的单个或者多个节点ExpandDepth                   声明TreeView控件展开的深度Nodes                               TreeNodeCollection 类型的节点集合SelectedNode                  当]]></description><category></category></item><item><title><![CDATA[分页打印]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/574109</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/574109</guid><author>hanbb1982</author><pubDate>Mon, 09 Jan 2006 10:13:00 +0800</pubDate><description><![CDATA[最近在开发中碰到这个问题, 开始一直没想到合适的解决方法, 后来有人提醒用CSS试试. 马上去查资料,发现CSS中有这个功能:page-break-after, page-break-before根据资料上的说法,应该是这么用的:br.pageEnd {page-break-after:always}然后在需要强制分页的地方用:]]></description><category></category></item><item><title><![CDATA[从数据库中读取图像]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/559695</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/559695</guid><author>hanbb1982</author><pubDate>Thu, 22 Dec 2005 22:55:00 +0800</pubDate><description><![CDATA[private void readimagebtn_click(object sender,system.eventargs e){  //构造一个SQL字符串和一个连接对象string sql="select * from users ";oledbconnection conn=new oledbconnection();conn.connectionstring=connectionstri]]></description><category></category></item><item><title><![CDATA[查找表字段的类型]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/541138</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/541138</guid><author>hanbb1982</author><pubDate>Thu, 01 Dec 2005 14:05:00 +0800</pubDate><description><![CDATA[select systypes.name from sysobjects,systable,syscolumns,systypes where sysobjects.name=systable.etablename and systable.cfieldname=代码 and sysobjects.id=syscolumns.id and syscolumns.xtype=systypes.x]]></description><category></category></item><item><title><![CDATA[ asp.net常用函数]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/540668</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/540668</guid><author>hanbb1982</author><pubDate>Wed, 30 Nov 2005 23:57:00 +0800</pubDate><description><![CDATA[Abs(number) 取得数值的绝对值。   Asc(String) 取得字符串表达式的第一个字符ASCII 码。   Atn(number) 取得一个角度的反正切值。   CallByName (object, procname, usecalltype,[args()]) 执行一个对象的方法、设定或传回对象的属性。   CBool(expression) 转换表达式为Boolean 型态。 ]]></description><category></category></item><item><title><![CDATA[ 值得收藏的代码]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/540667</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/540667</guid><author>hanbb1982</author><pubDate>Wed, 30 Nov 2005 23:53:00 +0800</pubDate><description><![CDATA[1. oncontextmenu="window.event.returnvalue=false" 将彻底屏蔽鼠标右键no 可用于Table2.  取消选取、防止复制3. onpaste="return false" 不准粘贴4. oncopy="return false;" oncut="return false;" 防止复制5.  IE地址栏前换成自己的图标6.  可以在收藏夹中显示出你的图标]]></description><category></category></item><item><title><![CDATA[javascript常用函数]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/540664</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/540664</guid><author>hanbb1982</author><pubDate>Wed, 30 Nov 2005 23:51:00 +0800</pubDate><description><![CDATA[/* -------------- 函数检索 -------------- trim函数:                         trim() lTrim() rTrim() 校验字符串是否为空:                 checkIsNotEmpty(str) 校验字符串是否为整型:               checkIsInteger(str) 校验整型最小值:     ]]></description><category></category></item><item><title><![CDATA[jscript参考]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/540662</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/540662</guid><author>hanbb1982</author><pubDate>Wed, 30 Nov 2005 23:45:00 +0800</pubDate><description><![CDATA[]]></description><category></category></item><item><title><![CDATA[Ajax:轻松上路]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/528670</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/528670</guid><author>hanbb1982</author><pubDate>Sun, 13 Nov 2005 16:06:00 +0800</pubDate><description><![CDATA[什么是 AJAX?  　　AJAX (异步 JavaScript 和 XML) 是个新产生的术语,专为描述JavaScript的两项强大性能.这两项性能在多年来一直被网络开发者所忽略,直到最近Gmail, Google suggest和google Maps的横空出世才使人们开始意识到其重要性.  　　这两项被忽视的性能是:  • 无需重新装载整个页面便能向服务器发送请求.  • 对XML文档的解]]></description><category></category></item><item><title><![CDATA[缩略图的生成]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/335584</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/335584</guid><author>hanbb1982</author><pubDate>Sun, 03 Apr 2005 20:44:00 +0800</pubDate><description><![CDATA[namespace ServerFlat.UserCtrl{ using System; using System.Data; using System.Drawing; using System.Web; using System.Web.UI.WebControls; using System.Web.UI.HtmlControls; ///  ///  Newfocus 的摘要说明。 ///]]></description><category></category></item><item><title><![CDATA[页面间的传递]]></title><link>https://blog.youkuaiyun.com/hanbb1982/article/details/324827</link><guid>https://blog.youkuaiyun.com/hanbb1982/article/details/324827</guid><author>hanbb1982</author><pubDate>Sun, 20 Mar 2005 16:39:00 +0800</pubDate><description><![CDATA[我在用户控件（UI）中使用定义了属性ImgUrl其中Imgkeji 是一个image控件。public string ImgUrl  {   get   {    return this.Imgkeji.ImageUrl;   }   set   {    this.Imgkeji.ImageUrl=value;   }  }在其他页面aspx.cs（用到这个控件）相应的位置是这样用的：（UI）t]]></description><category></category></item></channel></rss>