textarea与XSS攻击

时间:2023-11-26 09:12:32

textarea用法

一般是用来接收用户输入,用于提交到服务器端,例如 网站的评论框。

如果此框也用于显示服务器端回传的内容,则有如下两种用法

法1 后台直接插入

<textarea><%=serverString;%></textarea>

法2 使用JS DOM接口赋值

textareaDom.value = "<%=serverString;%>"

textarea content特性

即法1特性, 即使将html代码段插入textarea, html代码段不会执行, 仅仅将其作为普通文本显示。

<html>
<head>

</head>
<body>
<textarea>

<script>alert("aa")</script>
<div>bbb</div>

</textarea>
</body>
</html>

aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAAOIAAACGCAIAAABPF8HMAAAQc0lEQVR4nO1dW2wj13kmbKTwS+F1Y0betb1OCxStsQm6yOY1Adat/VYUKFoYeQjsGG3idYqiaLtZbF82xS78EKCIEaDoOmutoKUoXiSKN1G8U1dSvIjUnbqsKOpCkeKQQw6HysvawPaBMUPOzDk85AzJGen/8GExc+Y///nmnI9nzlxkq1gm25JU/mB9c3UhEtrcWsvlDsqlLMtSZ9XCWbXAslS5lM1m0xvJtYVIaCO5SlGHJDmBQHKqWOYEwzJ9vLW9FoouHh09PWOp350VMDxjqaOjp6Ho4tb2GlM6xmcGAsmJs2mBOojEI7tPN1kmjzdoI1nmdGd3Y2klShfBqUBpiLQplU+HY4unufTvqoUOeJpLh5fCQ0MPRzSPgECRVFXKGT4pKh2KhPL5w7Mq1THzpweG4FQ4E186XQYCxVDApiX6KLy0mMmkqmxeJEOp2HjYFc0m+n6eQEVTVSkfc5jcWt3eWTtj861ZzZ9VcQFZ5tC1Pju1PtP38wQqmlybUtR+MBxkStlq5RTDmkc3NyLJjWjNqajIHWrHEHQuZpb6fqpA5VJVKR01cmMzkU5vVZkchmeV0zP2NBzyGrS/1Y98vhKfP2NPUcElJjO7G3GsBFAKIkcxfzTg8ExZbVarzerwTPmj05GjWN+7BigfqpjSUZ3FQnpuca5EZ/BTaZU9DQe9Y/rHdovWZh4x6h6xlRwmPlXYG52zC65Q5zYXbHZbKBRKJBLJZDKRSKRSKavVarVZ5zYW+t47QJmwyabpdHJ1PVGt5NA8ZSu5cMg7Zng8adO5HEa7Vbu+EmJxVXIMk51c9k8/DXHanttYcDqdFEVVq9Xl5WW73W6z2YLBoNlsttvtFovlgjj1p//5s75rkPl5qZjSYZ3rm/H9/a1qJStIlslWK7lIyDtuGHTYR11TBodNu74aqrKn9ZdaqLrh3Zhjtem6Hz6Mmi1mmqa/+uqrL7/8kmXZ+fl509dwOp2rq6sT5onwYbTv3d3UX19DZAx/LGsbjf8KBnMO1UrqxARLYhp+Q4JNS9XcH7q00abR+OJpbh9ltWolFw56xo2DU3adxznmmjIk1yNVVnAG5dbdOUmaIq7Ghj0h7/T09LNnz549e0bTtMlkGmvG2tqayWTyLHql9RnfUl2q1Q2bCh7iZCD3SrtO4pse8zOQ2KaV0mGdC4vzJfpY0KNnlVwk5J0wPnZN6nzuMb973Os02s2aMf0Xeu1D/chD/chDneb/pmy6MyGbZql93YKjseEJ20Q8Hj8+Pl5dXbVarQYe3G53Op2esE1IeLYC539ebCpY5fzYtHE2nQ3NMMxJhUeWya6tBE3Gxy6H3uc2+T0mv8fkc5s8TqNzUj81qavRYR8dNwyyTJatZDkZiuWj0Tl7Y8M6vc7hcFgsFp0QbDZbKpUqFos6vQ4zKuT/opzEvzoTlrTuWV4MPw/qCs4vxMRgajX+Btptq77duEFoSslX21ybVpgTtpLlsFrJJpbmJq0jfo8p4J1A0e81Wc1PqrzqbCVbLh9zbDqqG9U2wGAwaLVai8VitVq1Wu3GxsbZ2Vkul9OOartnU76Z6ruYjc5sKphHcHQF3dByA19LsB9Q3kKZm2QbVSKSKqZ0UOf84lyhcMBWTgTInEQWvV6Xcdo3Me2fmPZPBLwmn9vocerdU7+ny6Hze00sk+FXLxTSnIu+YcKo0Wg0Gs3CwsL6+no6nXa5XOFweHx8XKPRbG1tZTKZ5eVlw4SRL5pkRkEt7ds1k1Q2XeJN3iSXb/7tEWYDYzgSM7XM3PKXgCoRTxVDH9QZi4eODnf4r08r5eNKOcMyJ9FFr881NuMzz/jNfs/43u4y/+apUs7wq+8fcm+hHLNTw8PDXq+3VCoxDMMwTDabdbvdw8PDw8PDGo2mtj056+CLRs0f+BISM/VyNiW0KcoEbW2Q+KkDmwp2b5dsmq5zfSO2sZlgy8fCZDIsk4kuev3u8Vm/JeAxTVpHtjbDLPMHX6Lqxte5D6QWDyLDT4aHhobW1tZKX2N5edlgMAwNDY2MjBiNxuEnw4sHEVRHtGtTVPdxloz4tamqGRznYWI45RjfkKwy+buoi0nj+lKwRX4twYbIW++KTct0us79/Y2Z4EzjA38OK0ymUs5Ew16/xzTjt3icxonxoeR6mGUymFpM6ci+4OE/3vclAoODg3q9vlgs0jRN0zRFUVqtdmpqyuVyDQ8P+xLIV6xKZzfGUg7s0nmpyvR+nXQh5Zv1Faj9SvkIzWOmdBQLewM+02zA7HEaxo2DFeYYU4WiUqMB4Zel3rh/8PGg2WwOh8PBYNBkMpnNZovFMvh40Bv3973TgTKhqlzcb+TqeiwcC3K+R+GQKR1WSsexsC/gHfe5jYnYNIONn4vMT64gPRdKh60B+xOd5tEXjx598eiJTmMN2EPpcN+7Bigfcm2az+04vM7syS7eqZXSEUMfbawGN9dCbDnD0IeosJPMjtZjWTyGL56AnVNVLqY43NiMTc8HGPqg8QWVINnyEVs+wkQy9IFnzudYg8+igaKoKhVTHNKFvdlgILIUbLy76ozB6LxxzhHLwR+ZAEVRVSrs8Umd7jp9rq2tROPjqnaZTMb1XlvkBP5kDyiWwjYtFfaymaTVORmMzJUKKc76tSVLhVQwMmd1Tn7x6DfDQ/8LBIok0qa1OdU74/FOe7KZbfIL/cnxlifg8c95qdNdTHIgkJwquvAUwyK1G1maH7OZF8Izp7mdEr2P4WluZz48PWYzR2LzRWoXnxkIJKeKpp62ZO4kOT3v15tNdrcjurSwt7eazWwXqVSRSmUz23t7q9HYvN3t0JtN0/O+k0ySJCcQSE4VTe0SMp/bWVld9M54LA6bwWIaNY2NmsYMFpPZYfPOeFbXwvncNnk2IJCcbdgUCOwXVTS1AwTKnGBToAKoKuZ3gECZU1XMbwOBMifYFKgAgk2BCiDYFKgAgk2BCiDYFNgHOmzaT259dOPG9atvvnH1zTdu3Lj+ya2PHDYtKr7Jpsvx6V9/9qs7d2/T1O6du7fv3L0djfiiEV9tu1b4689+tRyfRqUTn6FnBKl9kZHPbn70wY8G1GpBfvTBj/LZTX6tJpvef3BvZXmhUjqkqd3aX4nUPqOqbdcKV5YX7j+4hxIhPkPPCFJ7LyOf3Xzn5g9QHq3xnZs/4Du1yaZ37t4uFfbwb1dLhb07d2+jdIjP0DOC1N7L+PDH7w+o1e+9e9PrHrv9Hz+/du3t79+4/v0b169cvvzf937hdhree/fmgFr94Y/f51RssmntN9GSldIhSof4DCpVi+Vy/T8cwtltLCRJJVKqYIvylErSqyQxImW4ncbafHnr458U89uH+4njg5XaocP9ROF0q5jfvvXxT2oxbqcRadPaCqMl8bOpmAwkA8/ZRsW3TCVGKl+GbKWS5CeMESmjviQNeCdQTUzatPVFapM8CXVIkkESm+JtIV6qhDbttlSSXiWMESnj+nevDajVr33rW4klP6qJ5Xjg8muvDajV1797rUlb444iLvqcMMHLKMnYi5fa7vD3UaocLvpXLl8eUKu/c+1tfCvfufb2gFp95fLlJm2NOwG/jURHwG9DtSE+g5gO5Qw5PhVIbTdGpIzXr1wZUKvfeusqlUuimqByyatX3xxQq1+/cqVJW+OO/C/6+AD8vCWtVJED30up4tVKIuPGjeu1dadO+zmqCYPuUS3me9/7qyZt0nZHL9em/JK2bp+lWpvKXKoYwdLK+PifP1C/+uqLL774zVcuuRx6foBryvCXf/HnNZv+7KcfNmlr3On72hS1dOMHNIahZiP8FCVGKkqGDKWS9CpGmIQy5qatL//xy3/0jW+8cunlF1544aWXXqo/dbJZNN/8k1caH/IH5x1Im8phNu0ZQWrvZXxy66MBtTo4a//tw//5m3d+uPz1LX/AO3Hp0qW6R//9325xKjbZ9MGnv4xF/XgRsaj/wae/ROkQn6FnBKl9kfHeuzf/9NtX11ZmU7vReuFBKv7G61dqHn3/H/6OX6vJpvGl2fsP7uG/Lbj/4F58aRYlQnyGnhGk9kvGv/z8n9Svvvpn335rc22+VpJcX6h59O4v/lWwSpNNaWq3TKcZ+qCY3679v01qP5Hadq2wTKdpahelQHyGnhGk9lHGp/f/66/f+eHTnUhtN7Ub+8e//9vffPYpKp7oWToQ2F+CTYEKINgUqACCTYEKoGpc/zkQKHOqngMAsgfYFKAAgE0BCgDYFKAAgE0BCgDYFKAAgE0BCgDYFKAAgE0BCgDSpvcG3UCgeHbdppI0ALjIAJsCFACwKUABAJsqDyqVSnCXU95xWqkSSgiwqcLA92itpL7RcVrBPDJxaj9t2o0uEDla9SQdNNqDEeU30b2pFNNo79E3m3bp5KWySwdJem/THnhUfHJJ0B+byuHM60CJ6WBOlUKOZHokRN/Hqw827fs5c4DR05ZUsGn30GubYsagEYKH+LuYQ5zqjRskjaIEY+JRV8wO9JPnR6FlZ7abjTy4G+ipTcmtQLLdOLqYbPhgjCp+AL6hlpk71k+os2W7hA2JabpLkMVs2sHAtHWoXXu1zIaaqDCRnPgOTq1dr0g4oV44mz4nvjiiIjs41LFN8ananU1FHur4Mk2yTZ6tL5DjnT7mAk2SQSqbis8jrU3xh0iEdXbR77tHn8vkuSl+DUdSBVWdpCL5OkSkTbtxoSAJA5vW0bZNnzd3H2bBxCnHBKMOYZI3BvCFoSI5CQklkZysoB7OIZS2ljox5Zg8JM11Gxfinb5M+loq9Ox05NNv59+mhNMGQM44/zYFnAOATQEKANgUoACATQEKgExtCnc8gEbI4rkpYbkYSHKzDz+efkEWb6HID3UMqZ5JgVP7Atm905ePD3o52QPwkMsXUoRHewlF/JYuCGTxvSnmKMnrcv4u5hCn+nOh9QDJW29wai8hi6/3UQGYXcx2ozsx2fDBHagFdA8ymk3JjdLZ5bhl/pa2Jj8KkBYyWpsKlgtefPtuU/BojyGXO32SgcdcoEnySGVT8GjvIZfnpqipFLVLso3P1rIiiSRAbyCLt1CYeQtzx426nSe/c8ckbwzgCwb0GLJ4p9+v4QfbKQWysGlfgJ9HAbLCxbUpQEEAmwIUALApQAEAmwIUALBpVwB3ZtJCFs9NOYX8R5ukIggSdlxO2ByhDPHndaEgl7dQqEPtPjNq69WRmNehbb3u4pdLcl7nGK5JjWtyuL4rl3f65EdbSxH9pVVLAR14lCRtx42eP7gmNS5HX20qxgSkasR9RCLmV9Q9m0qSQaGQ1/emnDdD+Bf0mJjnvCvsc6HrbLvleP2oo907r4sDuXy9z3cVpla7kyVn+BsD2i1H6SeRKvl5nTM0rkf7vDZFzTfku5xCkrFEJWy3HNOc4KFun9c5Q+N6VI5rU8mHkzBhBzZFtShY3u3zujiQxZ1+x8NJOJbS2pSwpGUe8ed1cSCX56aC60jBSHw5qlCStSmJflRYN87rHAC1HpXFc9Pf1xG61eVv1IGvLljSWI4yCnk5qrmWYV06r3MA1Hq0/2vT84dzbCOZAGwKUADApgAFoBc2BQLFs7s2BQDkA7ApQAEAmwIUALApQAEAmwIUALApQAEAmwIUgP8HwrGBRR9ieXoAAAAASUVORK5CYII=" alt="" />

将HTML代码贴到此网站的编辑框中,点击运行看效果。

http://www.tool.la/WebEditor02/

textarea 仍然可遭受XSS攻击

不同于其他标签,例如div, 其内容内嵌script脚本,会被执行,

尽管textarea不会执行script,其仍然可遭受XSS攻击。

在插入textarea内容时候,提前关闭标签,然后输出script脚本,如下

<html>
<head> </head>
<body>
<textarea> </textarea><script>alert("aa")</script> </textarea>
</body>
</html>

HTML规范要求,内容中不能有闭合标签。

http://www.w3.org/TR/html-markup/syntax.html#contents

An end tag that is not contained within the same contents as its start tag is said to be a misnested tag.

规范上要求的 textarea content 内容为 replaceable character data

http://www.w3.org/TR/html-markup/textarea.html

aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADlCAIAAAAqSZJXAAAgAElEQVR4nO2dd3hUxfrHFxH12hERQQTL/YmIIoK9Y8OrXgu2q/QAoUiR0JuItEgLSGdJIz2k92x62fSeTSU9m2SzyfbU3ezO748Ny5ZTZkuyS3g/z/fhCSdzZt6ZM+eb2TlzZhkyCQ8EAoFAI0wMmaQNBAKBQCNMYO4gEAg0AsWQSlpxJBQ2NzZVcyqK84pyM3Iz2TmZ7JzMjNzMvKJcTkVRY1O1SMTFzAoEAoFAQy2GVNxKLX57Q2lZcXp2RllFSVtbg0jYKpXyu2QdXbIOqZQvEra2ttZzykvSszM45cV8fiNthiAQCAQaajGk4hYyiQTNFZUlGTmZTU3Xu6T87q4OCnVJ+U1N1zNyMisqS8TCZopsQSAQCDTUIjX3Dn5Ddn529fUyqbid2ta1JRXzqqo5eUU5gk7wdxAIBLKaiM2d316flZvJa6vvlnWYIF5bfVZeVmlp7vXqoqGQpwcTBAKBQBRiSERcPfH59RnZGe3tjV0yvslq5zVk5mZ2djQZ5m+mqqsK83ggEAgEopK+uQsFTVl5mVxurUzabqa4zTU5BTkiQTOYOwgEAg2zGBJRs7bKK4orq0q6pO30krV3yWjSlFcWV1QV6xVhpqqrCqzeaiAQCGTj0jF3Pr+OncUWC1up32pVO3sZJ7uck6P2d7KUImFLZk5mB7+B1rKlYq5U3ALmDgKBQBYRQyJs0ohTVlBfXyETt1GoS8LrkvKyMuL8vC77el4qyk/rkvIo0tfXV5SVFWqXYiipuCUlMcKVeVrU2SgVcakTV1fmU9Qnuyk3IScxkhUVGhYaGhYayYpKyEnKbsq1ekODQCDQcIohFjap1dlRn5qZKhRwafajkfKy2HHXfF3CQ7zCgj39fZhSSRtFepGwJTUzVdDZoClITxJRc3Zm/HtvvfzOGy/9vs5OJGiSiJrJEospzT21LD0sPCwjI6OgoKC8vLygoKC2tjY0NDQ0LDSVk054yitr2SDQLSqr2wfIlnXT3Ovry4tLCyg3K+BJJW1ZGXHX/FwiwnxiIv3DQ71KizKkdFscFJfmNzRUkJt7i7vr2S/nvffLj198/slbWzbZU/s7mbmnctKjo6P5fL5MJissLAwPDw8LC2Oz2cHBweHh4SEhIYT+bvX700whhIbtLNvXSK0XmaxuHyBbFkMsbFSrtCy/rq5CJmkllFTcKpO0ZWfEBfg5R4Z7x0T5RYZ5lRZnyKQ8zduuZOfW1VVwygs0BRmqo71+q8OqZYu+W7Lg2y8+e2fH1t9EgkaJqIkwcXVlnmE1shpzgkOCBQLBwMCAQqGQSqVpaWmBN4iOji4uLg4KDspqzNE7cai9Rs3Q5a9XkKY4vf9SnGU7lTIz21vI2S3V8la3D5At66a55+Rn8trqyAxaJmnLYrMC/J2jwn1Y0ddiovzKS7NlUsKhuv65bW11uQWZeh594yHqoDo7GvbtcVi94n92i+d/Oe/dXds3SETNhP5OaO6sjLikpCS5XC6XywUCQWBg4DVdSkpKAgMDWZlxeicO6Q081L6jbdN6/xL+gBkYTrRDXSPzz7XxzzQWaXmr2wfIlsWQCBvVSs9MEwqaCZ29S9KWnREX5O8SE+ETH3stITYgLto/PNjjmu8VX6+Lvp4XfT0v+nhciArz6SIyd2FnEzsrTVOQWlIxd9Ev37wxZ/pbr73wzhsvff7JW4t//Xrd6gUb1i5asfSHrz5/d9f29WJBo95ZEhJzDwoLys/Pb25uLi4uDg0N9TMgNja2vr4+KCxI70Qr3skWz5bsv2DuwxOA+QWBuYMsqJsj95SMZLG4RWIgqbi1pIgd6O8SE+kbHxuYwApMYAXGxwayov2jI3yjInzUigz3DvBzlopbpZJWvRzE4pbUzBS9AbhUzJ338ZtLFnyzbNF3dovnr1z247rVCzatX+qwYdmm9UtXLf/pq8/fPXPqkFTMxRm5+/j6REZGhoSE+BARFhZWW1vb2dnp4+ujd6LhmBfnX7JbzjANzgdw7TR68yp6afRS0rqbYem0aQxLoc0H6UJ9FnVNDU/XS4MTD0XdaUs34SzCq2x4hPCiEzYjfstb3T5Atiwdc5eIWww3BZZJWgvyUiNCPRNYgYlxQWRKiAsMDb4qI9pWWCTiEpr7D99+snmj3dZNKwy1eaPdol/+e+bUYUxz9/bx9tLCz8/Py8srJCQkNDTUy8uLw+F0dXW1tbV5eXvpnai5V436l/BepUhDcZ/r+RqZUxBaKnUphMEYmzNZvWidy/As/JoSFkTxA35rGP5gbPvgXB3CCGmvuwktb3X7ANmyGGJhg1ppmakdHQ1SSQuBxC3ZmXFxMf5J8UFJCUFJCUGJcYHxsf6saN/YqEHFRPokxAVKxVzD0zs6GtKzUjUFqSUVN2/asHzlsh9Wr/h59Yqff1v1i8OGpds3r9yxxX775pXr1yx0PLRTJFDPueucWF1JsGjdL8jfw8PDw8MjPT29tLS0vr4+JiYmKysrICDAw8OjoqKCy+UWFhb6Bfnrnai5XSnGUIRHCG9XsjTGmjtZ5tQZ4puOZS2GLBLCs7QrQhgPWU2N9VDD1qDInPoIZsxGdRgwd9BQiyEWNKiVm5/R1FhF8l4oVypuycmMi4+5lhwfnJwQnMAKqKkuNHyUKhFxDU9vaqzKzc/QFKSWRNjUJWnTbFQgEnCdju7bscV+19bVm9YtOeH4h1jIlQib9M4SCxqqKwjMPTIlyt3dPS4uTigUisVisVjc2toaGxvr7u7u7u7u4eGh/jkiJVLvRIr7h/oItaPhW6FRFkydoY2bu2nxWNDcqa+X+W1I3apD0fJWtw+QLYshFtSrVcrJ5ZQVSEXNxBJzpWJuTmZcQmxASkJIIiswItSzoixLKr7p5mTnlpYVcMryNAUZSsCv2755zeoVP+3car/ld7vjf+8VC5slwkbCxNUV+ssZ83iFmQ3Z7lfdXV1dS0pKhDcoLCz08/NzdXX19PT09/d3v+qe2ZCtdyLF/YNzhNoscIaKmmRkp2gfxBk/Gv5X+weyUwzjNDQX7ZSEceIYkyG08eglxmxVskoZtglhs2DGTHGh9Yobipa3un2AbFkMkaBerbo6TjI7meLVUImYKxFxc7LiEliByQkhrGj/oADX8tIsqZhLcZZY2JTMTq6v52gK0pNE1MS8ePzn+Z9t27R826blx//eIxY2i4WNZOmriMw9j1cYX5Do7Ozs6+vb2dkpEAgEAgGfz/fy8oqKioqJiXF3d48vSDQ8i9AUbE2EN785mdzSMjRKq4dkLVndPkC2LIZIUKeWoKM2PiW+g18nETWRq1ksbMrNikuMD0xJDGZF+wX4O0vEzRSn8Pm18Snxgo5aTUF6EgsbYqL8ly/+dutGu+N/7xV2NoqFDWSJRYK6qgr90bdGcfkJzi7OwcHBWVlZbDY7MDAwODg4JCTE2cU5Lj+B8BSr35+YIhsz3m6CdtCW1e0DZMtiiDrrNCouzc3KZVPv2yUWNkqEzblZ8YlxAfGx/gW5SWLK9Jk56SWcHO1SDCUVNUdH+Pl6XhJ2NooFDdSJq8pJzT2PV5hRnxWaGH7Vx4N5hcm8wrzq4xGaGJ5Rn2X1hgaBQKDhlI65t7dVRcZFt7ZUU/u7RNgkFjRxitllJRlSEVcsaCRL1sKtioqPaW+rovZrUWed+oVVUWc9bUpqcweBQCBQHq+QIeqs1RanLDcpLVEsaDB8NVT/FVNRk1TURJFSLGhISkvklOXpFWGmqsphGA4CgUA0Ygg7a7Ul6KhJYSdm57HJnmfiKzMnLYWdKOio0SvCTFWCuYNAIBCdGMKOGj3xedXR8TEVFQUUixdpVV6eHx0fw+dVG+ZvpirLwNxBIBCIRgTmLuyoaeWWh0ZHsLNThR21tJPgehJ21LKzU0OjI4oL0yrLsoZC7q7nQCAQCEQhYnNXj9/jkllxSaxWbiX+VExLcwUrkZWQGjcUY3YQCAQCYYoh6LhOpk5+dXZe2rWw4PSsZF5blVBQRyFeW1VaVtK1sODs3LROfjVFtiAQCAQaajEE/OvUamspT0pL8A0ODI+NzMlLr6kpbuVWdvJrO/m1rdzKmprinNy08NhI3+DApLT4Fm45bYYgEAgEGmoxBPxqHLW3VRUVZ8Yls0Iiw/xCAr0Dr3kHXvMLCQyODItLZhWXZLW3VWJmBQKBQKChFq65g0AgEOgWEkPArwKBQCDQCBOYOwgEAo1AMTrbq0AgEAg0wsTobK8EgUAg0AgTmDsIBAKNQIG5g0Ag0AgUmDsIBAKNQIG5g0Ag0AgUmDtouBUZ5rV2jd2cObOmPDl5ypOT58yZtXaNXWSYF/VZLemXy/c8Vf77fahfgvol5b/fp6ebx/c81cy+TJGVF7vdIbBnsYdikYdi4VXFQnfFr+6KX9wU/3NT/Oym+MlN8ZObYqF7/1DUffrsRqNk9YuFqR43R7THDl0+JN+zpKM+nzpxSlHpwitZU/ekjl6fxFiXNGZD0rQ/Uzd555RUc6hPlIpbFIo+lUqpIkU5MNDfJeXRBixp8O8pXKjI+0jZcLS8/vDVssVBFQ6V3FjqszRf4dtTfb12847cF1/NeGxqxrjJudNfKf/fYp6bp7KnB2lhmMN3EVLGJTTqIhp1Gd3BRIxziHEaMS6gOy+jOy4hxhnEOI1GXUKjLiPGJfRdhNQwB8ZBpBb1z53a5l6Yn+R06uj2nVsF/OrtO7du37k1Jzs+Jzte/bP6oNOpo4X5SWQ1Nz+HYROEapUw2lvL7Jb8MmH8eELZLfmlvbWM7Nzy3VPUJt5dFd9dFW9o7jrHdz5JmMn1hupNAT3/c1f+7K780U35g6vyRzfl10zlx+eV3zorv3VWfn1F+V+m8svLqi8uqYaiHabPbkTYkJm7jXQJjSQ+p1X/eRa9/wDa/oMq/pps60KylHxexTrP7Lsd0p85Xv+Gu+x9X/kHfor3fOSvuoifdLz+4Na0vQE5ZOdKxS34TdclayfLR8DL782fr0i4d6DMTqWQIIT+ypy+O/3J3elP7kmf4lf2WxuviOxcdebcf87XbtnJPX2u8eDfDfsPNx0+2nT0ZPPxU83HnCoW2nFP/qNSDJCZ+53n0J3n0Jjz6M5ziHEKzfBB58pQiQDVSFG5GLG4yD4V3c9EjPOD/m6Yg9q4tX8m/VeT7sDBfUWF6RJho4Bfrf6ePPW+keqf1QeLCtMPHNxHVnPzcxg2QajDH0Z7a9lHc98jc3a1Ppr7Hpm/G7o5tQxz4LVVrvPv/clt0Na/d1X+4Kr8zyXlfy4r7XyU759RfnlZ+RVT9Z9Lqs8vqb5mDgxFO+iZe1xi98w3mgKCZQihi1ck+w4KBpT05m4jXUItYeClvk+eUs1hILVOb5Gt/i9Z4u/OZ437o+htz54P/BSGesNddt/2nFVuWYTnKhR9eg7eLUeF7aiwHXXL9c1dqSS+fMLW/N6M2fK4ewdKlyDVYFszS37amfakRufy/8PjlRCejhBqc3Zjj53EPX2uIyi03cuPd9UbISSIiGq9wGy74lqzaRt77KTKpfZIpSI093uc0L2n0T2n0N1O6Hg+QgilcdFuNloRh35PRt4VCCFU0IEmOiPGWTT6goXMffvOrcKOGurNCoQdNdt3biW7cubnMGyCUIc/jKWLfp4wfvxnn86Ni722dfNvM2ZMf3XOrFfnzJo0ceL+fdtio/0++3TuhPHjly76mfB0883dI4P/o6vyB1fl9y7K+S7K712Un11QzjmujChT9cjRnzGql46qPrugmndR9ekF1ReXid3BzHbQM/eV69qnz2786odWdlaveh4mNq6b1txtpEt0tld2+F8Qvvdk10xGz8uMvlkM+SsM1R+L+F/PJky8zT/34T2F7/n0Ezq7Wm979vxra5ZbMsHYWaVSajddIU+1PGrgx+CBH4MHlkcp89tU2r9VqYg/ePXmzJfH/kueOEklF2kSK5T92a2eJ3Ln7kidrJZXyUrC0wck0qyp09hjJ6mVP/ttQVQsQkgYE5c/+23NcfbYSXzfAEJzf/AYeug4GuOI3EsRQmhZJGI4olGH0KgjiOGI7nVCXwcjhJB7GWIcQ/f9YyFzV//Np5VESDoPaH4ODAbNMwDGDfT+q30QJyszQyUs0TZDxWlVnDRmhhEb7a8em69ZvayzvbKxrqC5YfAGbqwr6OBVdLZXrlm9TJ0mNtrfMAfzzX2Nb+/3rsr5LsrvnJXfuSg/Oa+cdUzpX3jTFH4PVj1/WDX3nOqjc6p5F4nN3cx20Ji7QKhECG3c1jF9duPilbyAYJna3NPYvbTmbk4MhJ2QrGdSq9XnLPf1Se3PMzqmMwQvMEQzGL0/zuT98FbjAQeCy1dT9vC2tDevdmlb+bvefa+7Sd/VtftXrgin7Eo1zEGlunmlhD2qb3265/v2+JUpAsoVP/j3fOfb09l9MwGhuYvrfPqj/9Uf/S9FxQ51si65MuS6zLVEXNTep1QNZLV67k17blvK5G0pk8uaowxz6AgM0dh3+U+LlN3dsryC62s3CqJiB7q7y777n+a3pV/OJzT3xxzRnX+iVeEIIbQiFDG2o9H70SNHUUYz6uhGPQr07Gm0IhwhhGZcRmP+ttzIHafHUI/czckBxy71fiZLT5uVOaEahmGzoeLkj5nGzDA0U+2JcUFkRUSEeWkm3w1/q//BmxK/gBDDHH52G/jWWfnNFeW3zsqPzytnHlX6Fd48RSpHTRLkEKp67aTqvTOqT86RjtzNaQe1uecX9k2f3bh0VXtdg3z73s4STr9Yoty6q/Oqt5TXPsDO6qU2d/O7BFnPxDf3Zs8z1bMnNrz2WOPLDzY9f2fz/zEk/32+Yd7MuguHCdMfCs+feLBC28SfPl4/emPq03tSx2xKn36m9QM/xTvefS+cbRu3r+TjkxmGOWibe0hZ30sn+H7Fg08vQ8t6X3bqCC69+XeR0Ny7sn7qi7ynL/IeJT8WIdSnUP0Y2jrHvVGtmLouhBBXVvpH+otbkib7lKwzzKHpyHG1d2c/PV0uEMiKSvoamzMff7r1sotqYEDe0Zn99HR1gqwpzxGa+/j9aPIhxO9C4eVo1E60OQptjUZzr6B9cehIMtoRi+xD0YkMpEJoexxi7CM2d5wHqoyDyIbMnbZvYTomtZmaH6oFzX2oQ8VpVcw0ZoYx66UZE8aPf/yxxwryEsiKKMxPnPj44xPGj5/10gzD32p7d2tra1RUVHZ2tvq/CQkJUVFRUVFRxcXFCKHYhPRVazcY5vCTi+K/V5RfMZWfX1S9fUrlW3AzQ54MFbWhrgHUKEYfn1e9clz10dkhNPe/TwrV4/SaWv3Z4vc+5U6f3ejpK7WKuWOqtTi5aPr4mm/frvv27drPXqp5baJ03tPVbz9T63KK7JTPT7NnnOdpnP3F87xn/0grqSrtbK9MKSodtz310X0lozemfnIy42RUQV1juWEOanOXD6g6M/Pz/rqwfLl3cJ5Q3WgRpV0vHuftjO9Nb1b2D5Cae2/cv/vC7u4Lu1vVXY8Qiqnresm1QaP5wYMPbCs6Ex0SJx/Jet8wh8YDR9Te3eR4oqu0LOuJfyv7+ip+WdJTdb3p7xP9La3NR53UCTIem4qIYnhoG1roPoBQ33fOqnu3oUsZaECJuuWoRYrqhYgnQ4oBlFCNsptQSBm6Zw+BuePrFpuWMeydhJ8xabMyP1TMaG0hVFuYlpk0ceKE8eNfnDGdupQXZ0yfMH78pIkTDX+lsT+xWLx161Z/f/8DBw4EBAQMDAz8/vvvGnOXy+XrNu1KTCb4XP+D68AXl1X/uaSadUy1LezmMFDt7FwZ6uxFOyLQzKOq151UH5wewmmZq97S6bMbX3mrSSxRcsr7v/ul7YcFbc1cRW+fSm36u/Z1Upi7+ZOKhJ2TtpM0N5bVVHOaGspqI7yyn36gZv2S2jW/lH08s33OA3nTxlU7n6Q4d8b+1DkuYo25P36g/FD4zRWThdUc9+TCqnrStVKd7ZUqlUrcq1we1vWZC5/39lzZ2+/xv/khO7c5rqL7l8CueV6yD92lc91lK8K6xL1KQnPvC7u3N+Tu3pC7Vb2tCCHHbOG0Kw0azXBpkPQPTutfKlq0JfkZwxxaL7uovbuvsanhjwPssZP6ee01G7f2t/Gqlq+p/+NAP68949En2WMn5U6fTThyf3ADOhja3cITPLsHPbkTjd+Gpv2J3j6OkqpRbQcSdKG/YhBjLQoqRgXNaNxughycEjswdfOKJiaE4fSYxIQwstY3PwdzbEjPKKmzglCNTWNmGE9MmjRh/PipU6fw2wgGZWrx28qnTHlywvjxT0yaZPhbjRcXFBQcOHAAIZSamnrgwIGOjo5du3YlJCSw2Wy5XH7msqfT6bOE99V3zgPzLqo+vaia7qg6kTRo7rwuVNSGWmRI0Ic2BqMn9qnmnFC9dlL17iliczezHdTmPqBE4dFdnPL+xibF6+83qw193jctAqFy+Zr2mW80JSb3UJi7mTGQdTzqPpCeVpCdXV9XJ0pMrIyIKE7+z7zsD2aXfPmW6MVRadMn1kZ6U/efV4+kv8IUaMx9yt81i5xvroo5HJZn754dk0+8RkUtlUq1lyWecZp3MF7YX1IqOnWu4eW3rry/6smj7S+ebnNiy0p48kPJ0hmn2v6IExOP3EMf7g28qzfwLqXsOkLodY+mpy7Va8u3QqruFXltwZsTnzXMQZqbzx47Kef/XkIIFX/8BXvspP42XtXKtd0VVbVbd+W9/AZCqOjDeeoZecJOOGEdOh/VmV7c9swW9MxWNGOXatpO1b9Wo61+iqqW3nq+fE+IkrECubBRUTOasNVCI3fbn5ahTkA9RrZsqGba5XCGan60FgljzpxZ6vl0H69LZEX4+TDVaWbPftnwt3rTFwMDA2fPnr106VJ1dbWDg0NoaOj+/fuPO515c+43IpGY8L76ijnwyQXVR+dULziqLmeq1M7OaUdt3UjYhzYEqx7fq3rluGrOSdUrx9GbJ5VD0Q7aq2U6OgfmfdOi/crST4vaevtufqQYnmkZnG6QmpxXUcHv7kYCgaKpqau8XJgVmcd6ekL506MTnxnXkBxK28GWOmf/26lRY+5veXTfvTljkXPW5fiir86y79+R+/Sxuvu2ZT+/L3WNR3ZOGcEQXqVSveLUOOtko1I52ERln3z70YaYx/bXHYwXqI8o1WmcGonNPXZWz7UxPdfGKEXFKpXqcrF40vn6iTf0eyI/p3Vw1r5FWn4w/QOCGJTK3Blzcv7vpe6yiozxUzInPKWSK0rmfd0ZHslz9WCPnSTNyin/ZQl77KSWc5cIO+GU1eh8SEssu+7539GEVehYoMg3qfORlWiDS29xjaCkTnIwqG/0UuSfJc+tVUzeRDrn3mnwBFXveOetZe7UfdGoYYil5txtPFRzArZsGKtXLhn/6KOjR48eN/bhmEhfwwQxUX7PT/s/tbmvsl9qmEDb2YVCoZOT0+HDh4VCoeZgQkLCJ1/9LywiWv1fwxw+O6+ce071/hnVtMOqwGIVQqhFhvjdqFmK1gepHtujmnlMNfsEmnUMzTyK5pwgXktnKXMXS5R6zq7WAjueVKYcTnPHeYYUGlogk6mCggojI4saG7vKywUpKfWBVyOKzzq2VpO+dqStoKyi+3fkqt9a0vj71KM1j+3nPHuy4V3vPvXBOc6iJw5XfnCC+IHq9MPXH/+jsqtfqf7r/pVDzJitFXY+LdrPWg+x+JuC2ogfqFac7gl6uC/lPyqlHCEUVC174kL918Gt21M6X3Bp/Nifq8mkRVbpWUDw2AYhVLtlp/aSGGVff+akZ+t2/tHX2Mx+5ImMx6ayx07KfPzp/jYeYSd82g5tv8jLzSt402FgynK084qgvKLqmdXoVKAgJrPNNVaYWdr+9FqUXCQJzZJNWUu1WsbQ4vUTaA5Zfc6dbEraMIF2MrKRL/Vw2FKLySg+4dpCqDitShGYBcNITQp96IGH7hozZuzDD91xxx333HOPZr1jWIjHuEfGar/KxE6LJLyv1HR3d+/fv9/f318ulyOEkpOT9+/f39vbGxAY9PPCFZpkhjl8cXHgvTOqd/5RzTmuWuCp+iNGteqaarmf6ksmeuov9NJR9MpxNPMYeukoevFv9MbJoV0K6ewuIdtywNVDSm3ull0KifPxMSWlOigon52WkxDPjooqKysTxMdfj4ogeLBBoTmH0qf9w6VY5K6ZsVniTPAek0ql2hvRxlhf/O6pmsvsjq8u1jE2lMw7V9uv0Fnh3iBWVXYSz7mLqjNUvCZERm83Ovc7+u9YdHZjUXt0RXMcYSfsKirRmHu7j78wLoE9dlLuC7NVCkX5z4vUx+t2/kHWCV9cjr7e2cMpzl5/suOpRejr3T2FBQWRSRXlZSUO54Qfbh0oLK1nZbY0Nzce9RNPWW4hc7eFkfuwCUId/jDWrrGbMH48OyX88sUTn3z0fuGNZTOJcUEPP/ywxtkdfl9DeLrmHkxOTt5wA7WtX7hwYcOGDUcO/9XWevPWNcxhvb/s7dOqN0+p3j6tmu6omvynavKfqif+RE8fRC8fQzOPoRePohf/RjP+Ri84IjsP2VC0g8bc1c9UCeXsLhnSkbsJOno0Ii1l0HCvusfn5LSYYO7pHM7D21JfvtRJ4ezPneY+tj2lspZwWkbZp1D+4s1l7Klk7Kxk7K78wqVR0jugZ9H/Zba8erSO7CUm6Ym1A0Vphsauyo1VLXlB9fGd6JM70Sdj6nkEHx00nbBy8Qr22El5M19XKRRVdqvVhs7z8Om5XpPx2NTsp6bLOzvJOuGr9mjmcuQbUZmRVfDhBvnTv6Kf9srO+9ZtPs1/YSma8gta8Je0ua4oI/f63E0DM1fSTMtQbCzTqW3uBw//mZuTQN1dcnMSDh7+k+zimZ/DsAlCtUoYn3069+mnppQUpdRqfZZvqM2f/MQktbP//MM3ZOd2ifikYy4DukUdhjlkVdS/4cF1fBEAACAASURBVKR63Un16knV7BOqV46jWcfQy8fQS8duePrfaLojet4RTTuCMsrrh6IdNOYulSnVr6fO+6bl8DHh3yeF3/3Spn6hiXZaxopdorKs8OLFhIKC9oCAgpysbGNPj8wtfmRb6tPH6jTzMNrvpj5xuHLCjpRMTinhuZrtB4o7+gNquvN4+rsRDDpve18ht5ds+4GOhnzxklndm/7TH3RBkRWjSA2Rux2QL58j/3C0Yu7ogY9Gqz6+U3HwJwG/ivB0dRFyPj/vpddaLzD7mrnqeRj1U9Z+Xnvl4hV8vwCKEcYce/TyCvTZ5r4UdlF6ZoHDKf6nDv2zVqB31g0sOSA+5dmQk5sXnVj65bbel5ahV+2JH6iSvbWk/dtObXPPz0s5cHAf9W5EBw7uy89LIbty5ucwbIJQrRXGut9WjH/00WeemlpWkqY+Ul6arnb2ndsIZjk1ij6zRSZow3F2maAt9uwWwky8MlrUtq4eqr+kNVSf7oimHUHTjqDnDiPvjNYhageLbBxmrS6RlpJ1+XJSVZUwP7/1yhWCWQscFVWXfXkmc8ym9AkHyqYerZl6tHbK3zXj/yx9cGvaKvfs6+SrIS21cVhnY6Fo+7eiN0eJ3xwlfWuU7O1R3e+O6nnvjr737+j/aEzPqd8EPNIFXZr8e+sarq/bVDz3c+0tBwrf+bgzLFI7DMMc5tijV1ehmcvRBxsUR1ya41NK2JkFyelFaRmF2dn58anFjq7N761XvGSHXluF5ljK3AX8apGgXixo6GyvFAsaxIIG9RBA/bP6oEhQL+BXk9Xc/ByGTRCqFcM4fGDXxx+9f71qcNxXW5374/z//nOK+M1GjYoSrl5Y+capn/5Nqwsr3yhKuEqWT3JJ40Y/6TunBuacVM4+oXzlhPKV48pXjitnHVO+flKx1leSWtowdO1gkS1/rdUlTp4IDw0tDAkp9Lga39JEPL7GVGE150xMwY5rudv8c3cF5l1JLKyuJ7VUjSy45W9nRpDor8WiH6dJPviXdO59sgUvyI4sExXibvmLEFL297e5XOV8/WP2szMyHn0y9/lZ7V6+en9jDHPY9I90jj161R7NWoGmLUGvrVJ9sa3vu13d3+7q/mxz/xx7NH0pmrUCvWqP5tijTf+QbvnbSblaRn/7ARAIBAKNGIG5g0Ag0AgUmDsIBAKNQIG5g0Ag0AgUI8D3EggEAoFGmBjLLqYyfr0ynMJfz3TrwGc5MBhMDtGvOEwGg+HA4uul1jnCZzkYnM1h6p+GjcyNUeVGGAxCiC/YzWgt1z1Wzqx6x0HQoZ9Mk0l/ooP+KThllTOr3tEvizB9f6JD1W6WwE0vBmNixi6LDuOuBYdJdt1p89HpMzpdQidTnHhw+hhtwEagzpzFJOufJsZMeBtZoizEYRo2Bp/FNPYetFg7Y8SDAYfJMChEu1wwd4tAY+5EnUbrGFG/MsfdqUytg9XwDlNmUFbrO4yGRL5BSkZrOULlTAqLxDTQ/kSHqncYgyI0dwNrNiVmjLJoMPJakN7D9Pno2AKpuWPFg9HHaAM2Bj7LwdBWdH9tUsxE95ElyiJJZZGYTWpn+niMRN1Kg4C5WxSzzF3nwuhhUg+gMFwd49OT4SnlzKp3GFUExopVFkKDfyG0M6cYufeT5IEbM15Z1Bh7LcjuYYx8sMwdLx5rmDv5uMP0mIn+ilqirMGMKW6oYW9nmnhw0cR9Ix8YuVsc883dkn/H6cydyqwJsiK3XeqyBt1W97emmjtdzNhlUWPstaA0d/qxIp6508Zjg+ZuUswmmjt2fW44qqGpWqedyePBguhDDZi7xTHf3E2cXieEztzJprYNKGdWuTHJZj9oy5K5EYz6TTV3mpjxy6LG2GtBae7U+eCbO208NmjuJsVsorkbfe8MmqrezKj12tkwHuyzqMIBc7cI5s25E14lMzD2IScJnFa14RI8bsUpiy/YTTDqN8HcMWI2oiwajLwWpPcwfT54c+5Y8diWuZseM9mcu/llGabQy3dY2xkjHnqI/x6BuVsc88yd5HTjH58Pom9q5Swta9ZZBqOhP5GpZ98yrbUrFOZLXpblzJ0+ZsuZu5HXgnq1DGU+eOaOFY8ZpsNhmdDH6IwIN2b9PIgc1hJl8VkOhlnoHRzOdsaJhxYw92HCTHMnmD4z9lLrUM7UmqO4MQDXYDA93Z/ooD/xor9ChtNKtvKEvCz1g9CbOes88OS06gZAPbNPGzN+WfQYcy2oBmg0+WCaO048RpiO7nEO6QpDSuhHmXgxM7TdiWRZjCXKUqcwWH1MtBBzWNoZLx469HPRebjKYTI5YO7movecnfARvf7jbOKnKDo5mTkHL3PTLCkhfBTJF+y+ueZEx9k1tqgxU+0jRLlRlKW70IUpQ5oVOA6CDs3PuiJ1efKYccoyDpproX0RyS4ndT6aHBxY/JuJdP5j8NmOMB7j+pjeb02Z5dWHtKdSt+Gg+WknIr13zC2LaC0McVbD08748dCgmxGTg3T+aIK5AwAw/Fhk8h+gAswdAIDhB8x9yAFzBwBgeNGZcgGHHyrA3AEAAEYgYO4AAAAjEDB3AACAEQiYOwAAwAgEzB0AAGAEAuYOAAAwAgFzBwAAGIGAuQMAAIxAwNwBAACMwbT914cdMHfrwGexbLxn3MJwmDZ/31kam+1PI/FaaG/6Zu1YqABzH2Y0HYOwyxPsBQpgMgTvtFtyn86hwkJfxmlZRvj+AjeqZ6Nd4gZg7taAdNMkHHMn+hoXW2dYY7bMllR6W/Rb+tuyjIeiDW13Ey7bjYwUvL7KZznYfMXA3K2BOV2ez3Kw9U5lwPDGbBFDMfgmHWubO1Ub2q6F2m5kZOD11VtitgnM3RqY0eVvhRGDPsMcs6XM3aY+dFO2oe1aqO1GRgJWXzXxC6yGGzB3a2Bylyf5KjKbZthjtoShmPCtZ0MJTRvaroXabmSEYPTVW2h0BeZuPjqP3Uiuu9YTJgcW36DL02ZB9MVc5jyswnhUSJFE5yGebtWMiln7uduNc28eo/puMirjNcdQiL8/j7A8jPbBqhcleNddU2PSa0GYnxkehZsP3bUgzUddk8F75cZvNampv0iP8Ov6zO2rFsewSKMKw+hjYO5motd7iaZmOUydvjR4UfG/Ttu4BPToDU8Iv0Vdrx4E1eIwGQwmS3sYQ/ot4bQx3xgnaxIajKDo4zGiOAzoRu548dDXCxvKSnGYDAaTydS/qDTf5WzyYwQj8qEPmzQfnftE4/VEmdLGY8m+ahn0x/96HmFkTiR9DMzdHIg+onGYBN+ETGD31jJ3Qy83PEL2Le8G9TIc/hB1UExzZ5HOZOLEY0RxGFCbO248dPUyAlqXpLsWOH0VB+PyIQ+bNh8d/9Wpjk6m2PeghfqqRSB6osNnMU03d8I+BuZuBsTTb7o9i7DfW9HcCf7W6Js7yahG73YgMziC4LDMnTwJXjxGFIcBlbnjx2PBxw3GDIGJjuH0VRyMzIdy0S91PjrtSWruWPFYsq9aBAtO3FP0MTB30yGbp9OedCE2AuuZO+nHUYwkhn+1LGnupB6DGY8RxWFAEZER8VjwsayZ5o7TV3EwNh+ysDHywTJ3vHhsztz1HgWYA0UfA3M3HQyjBHOnOKxbJJg7JZYwdwuYlrH5UJo7fT/EM3faeGzQ3DWFmfAXVgcw9yGB8EkkURowdzB3c7GEuVsgFGPzoTR36nzwzZ02Hls1d+1CTTV4MPehAWe5gS3OuRP1Ba3HOSTdZYjn3MnvULx4jCgOA7o5d7x4bMfcsfoqbhxG5EMaNn0+eHPuWPHYmrkT7XBgal8Bcx8iiAdxuo+9CdyUokMabe4clpEdgtjddd65I11Hp78CwcQbxiBmmo6NFQ9tFEZh/GcJ8tUyQ2LuOm2Icy1w+ioOxuVDvVqGMh88c8e+By3VVy0Bn+Vg2C0ID2LlBeY+NBg8qya4RLq3PZ/l4ODgQDbRRm9MOilMeg/aYGGY4cIs/WoR3EFG3DC0MdOaIEY89FEYA830FWY8FjR3yjbEuxY4fRUHY/KhuhY0+WCaO048luyrlkAdscFKVbPWuRMA5m4+Ok/syQeTWgkM+gzhQ3+qG8bcxzBaeVAOrYhj0T5b5/MxaYbEMetEQVdtumYmzMzoFiK8EoSZYLYPbb2woW9D+muB0VexoMkH+1qQ5qPJwYHFv5lI5z8Gn0sI47FUX7UkRJ3M2IuB0cfA3AEAAEYgYO4AAAAjEDB3AACAEQiYOwAAwAgEzB0AAGAEAuYOAAAwAgFzBwAAGIGAuQMAAIxAwNwBAABGIGDuAAAAIxAwdwAAgBEImDsAAMAIBMwdAABgBALmDgAAMAIBcwcAABiBgLkDAACMQMDcAQAARiDGmfvohc4PLXefuSPoi79jll5M+c2V/dPphNf2hDy88ursXcELzyX9/E/CzB1Bdy12GQXmDgAAYD2MMPc7Flx5fI3Xu/vDt/vk+GbU5td11POloXkN61zZT230XX45lVXCjSvlrnfLmLjWe8wiFzB3AAAAa4Fr7ncsuHLvUrcF55Kii5pqeBKBrK+rT9EnH4gv5a51YU9Y4/X9qfjQvAauoMsno/brE6yHV1wFcwcAALAWuOZ+71LXObtDTsdwWkXdbaLuzOvtUUVN4u7+pLLWtS7p41d7vvFH6JHQolZRd04tf++1vIlrvcHcAQAArAWuuT+6ysP+Slo8p0XaI08qa93lm7PsYkpdu1Rj7pPX+fx6NrG2XVLPl7omVz210RfMHQAAwFrgmvuT63z+ieFUtIjq+dLFF5L/z8H/tT0hZVyhxtwfWenxuWN0VasYzB0AAMDq4Jr71A2+LklVde3Sylbx+39F3LfMbfrWgNImgcbcn/jN++d/Emp4MHIHAACwPrjmPmW9z4W48uo28XWe5MtjsePsPbTMnT1hjdec3cF7r+VxBV01PAkzsXLqBjB3AAAAq4Fr7o+v8drrn5dTw++Q9jITKz4+FKkx93Wu7Kc2+NpdTk2vapP2yosbBX+HFU1eBw9UAQAArAauuT+43P1zxxhvdo24u6+sWeiSXHUopLBV2F3OFXmzaw6FFIbmN7SLe7p65dey6r6FpZAAAABWBdfc71zoPH6V5xavrKpWUXefXNzdxxN3yxVKSU9/q7BL1NXX3aeQ9sjLucItXlnjV3neudAZzB0AAMBaGPGG6p0LnWftDNrqnV3ZIuruk8sVSpVKNaBU9isGFANKcXd/Xi1/jXP6C1sDKJwdzB0AAGAYMG5vmYdWuM/cEbjWJf14ZIkXu4ZVwk0ub2WVcL3YNWdjy3b75X5yOGrqBh/YWwYAAMC6GLH9wP127hPWeD3xm/d9y9ymrPd5b3/40ospa13Sl11Mee+v8Df2hn7wV8T/ziTMPRg5Zb3PXYthbxkAAACrgWvu99u5zz0QudUr+2h48Tt/hj2+xut+O7dx9h7jV3s+au9xv53bG3tDd/jkZNe0X8uqW8lMfXSVJ5g7AACAtcA190dWeiw4l+SVXpNa0fb9qfgnftNf6Th1g++SC8l17dKSJsGx8OLJ63zA3AEAAKwF/t4ynmuc0xM5LfV86dKLyYbvKN271PXtP8PKuSJ4QxUAAMDqWMzcH13l8dWx2Oo22FsGAADA+tCY++iFzuPsPd7eF/abK9stpaqMK+yQ9l5OrNjkkbn4fLK2dvrmerNrOmW9FS2if2I4U9bDtAwAAIDVoDH3uxa7PLXBd60LO7qo+XqbWNLT3ycfqG2XFDV0Zl/na4sr6FKqVH3ygaSylk0emRPWwANVAAAAq0Fj7qN+vXLXYpe394UdDilq7JANKJVqB+/uU3T1yrXVrxjokw/UtUv2BeQ/vdEXlkICAABYEaw59wlrvD49HHU5oaKiRSTrladX8QKy69xSqrV1Mb7iaHjxxquZb/4RCi8xAQAAWBfcB6oP2LnPPRh5Mb6isKFzl1/uV8diX90Toq1pm69RbykD5g7YDhzfMJbA2kEAwFCC/4aq8wN27p8cjtp4NfPTw1HP/O537zI3bd2zxBXH2UeOuQvKHGhqms6xdozmwPEdCbXQhcu8eXXA3IERjnF7y0xY4zVnd8hHByN/Op2wxiV9p2/u3mt5O31z17ikz3eKe3V3yL1L3W4Xc1czaPGGTnHDR3y5VonLbG76ILPK2rFYGHXVwNyBEY5x5n6/ndv0LQGrndN9M2pr2yV98gGEkHr9TGRh076A/Jd3BD1g534bmfugUxAPb/lpYbeuvw8G71jGt3YklkbKcgRzB0Y+xpn7hwcizsRySpsEAllfn3xAqVIhhNTrZ0Td/ZUtonOssrkHI8HcdX97m/iIlOVo7ByOCaeYz+1m7lZpZBxsNrARAq65j1nkPHGt11av7HKusKdfUc+XRhU1/RPDcQwrPhXNCcltqGgRqb+k6Y9redM2X7tniSuYO7oxc+2QJh3WoKwDl2n0BL0Jp5jP7WbuVmlkHGw2sBEC/q6Qbh/8FeGZfl0xoBTI+vwza389mzR5nc/9du4T13p/fYJ1OaFCPVETWdj069mkR1Z6gLmjW3xmxjiq0o1++mrCKRbgNjN36zQyBjYb2EgB19zHr/L8zYWdVNYikPX5ZNT8eDrhEXuPMYtc7ljgPGaRy8Mrrn56OOpEZGmbqLuoofNwSJHhtpFg7iMatWMada+acIpFuK3M3VqNTIvNBjZywDX3J37z/jusuKRR0Czo2uKVNWNbgF6Cx9d4zT8Zd71NUt0mvhhfYbiz2O1p7hadlpGyHLGfcArKHMz9iyJlOWJGrr5RjbpXTTjFUtyK5s5lmvJkexga2WYDA7DNfeoGX5ekqrp2aQ1PMt8pbsIaL70Eo369MmNbYGmT8DbbFdKsB6o31pIPimjRofbS7CuMX3XNvSrd8PjgZ4XBjwtapw8m0Dpi4P43z70hSnPX3KKkMqiRCacY22K66L6O4JAmHSJz1wsM47Oa3pUljMfw8uldI8KzhqGRrRGYwZslzCqEEJc58j8Wm4jFzP2uxS6v7g4p44K532TwJiHsfFXp+tY56NTkYxl15x68l6QsR03Og3fazdzUWfmmax5YqW88ZlqZg94R8nvJyM8cQz8tY3yLGVaBnxbG+DXMwbLmThAG1uc57Y5BtfD05nXnMnXOGvRKSqceykYexsA4vgaXTDOyGYGrdS2DEdMyR8OLSxoFLcLuPwPy5+wK1kvw7O9+K5ip9XzpbbblL8ltrBllkDs7QdcfPIvyc4BjGR9JWY7apxvcS4P9XutmMLxFDW9jXdR2YyvmbnyLkcZP+t6ZSagb1tBfBv++Elx9tbOT1oXgFPV1D3Mge1eOyt2GtJGHMzDyTzZg7iTgf1mHx6orafGlLZKe/ngOdyUzbdJa74dWuN+3zO1+O7cJazx//ifBi13TKevNrOZt98l+3GBoP6LNnVCUHk3yWZJyvDzYlVm+dNMRhs6Cc0QXWzJ341uM6s+kBadlSKfdbsxRGARA2ewkH6coJvdo23AoG3mYAlOXTpISltyQg2vu9yxxnb4l4EJc+YBSKenpTyprPRBc+M0J1tt/hs09GLHNOzuqqKlT1qsYUPpk1Hx0KJLiPVVrV9my0HwAJ4BsfIQQonkvFHtLgxFm7sa3GGXwFjN3qqVQxM1LV7TOzJsGivEpbV2GsJGHKTDCORmdfG6tZ+PDB/7GYVcesHNffCE5gdMi6ennS3oL6juDcurdU6u92NfZ1bxWUbe0pz+B07LaOX3Sb95jFt0m+7kbbe6kn8rVUM0jY5c1sszd+BajnvO1lLnjzCzrQjPtRhbbcHioSd1ymMxdM70+4rY5GlqM235g2uZr9lfS0qt4rcJucXe/rFfe1SeX9crF3f1tou7M6+2rndOnbb5GnYm1q2xZjDV3+gUDNOaOM8M4oszdhBajXqRkKXM3fm8Jsgl6LYhMdhg81LRuOVzmjnQXht1iy1ithnHmfs8S1yd+8553JHp/YH54QSO7ipdTw2dX8SIKGo+EFs13ipuy3odi4wEwd1OGe3pl3a7mbkyL3fLmrtvsw2fuRnbLYTR3NToWD49SaTDO3Bk3vjL71d0h3zvFLz6fvPRiyuLzyd+fin/zj1Dq2Rgwd4QQmLvxp9yO5m6tkbutm/sNtFfiw1wNGQTmfseCK3cvdnlk5dVHV3maoEdWejxg537HAtIv7rB2lS2LiXPuJr2zenuauwktRu0s1p5zp18gaLU5dyO7pdXMfRDDJb+AFgTmfr+d23MO/gvOJa1xTjdBC84lzT0Iq2VIod9tRlDGpFwKeSuZO2ldjDjFhBajfDxosdUyGIao93Y+bdGE3WkIPNQSjTw8gdFspEH3usbtDIG5T1jt+dmRaK/0mkROiwnyZtds8865zda5GzUAoX19keyWuPXMnZ8WRj6wxT/F+BajqJ0FX2KiG4nz08L0G5DSjEja3PIeaplGHp7ABDdfqyZAUOYA5k4Cgbk/ud7n17OJnGZhV5+cVt39Cs23dqi53ia+BBuHUUIxSuKnhZEbri2b++Cb/frzCZTR4p9iQouRLI7WLAuxzGd5qsF7VTrhxSJdtU36p8IcDx3SRh6ewKjeriJ/eRUgMvfH13h9cTQmOLchp4ZPq6KGTs337anJreX/cS1v4trbY8tfU4eBhG8wcnwpvZt+lfQNrGHuBt6E8XaJMacY32KGc+LqbRu0l/1ZbHKG6C0qY/YKpXjWSv+2LcZ+W0PRyMMUmOYlcOLPZzBsJ4PA3O9b5vbs734/nIpfejGFQnaXUlddSWcmVpa3iHr6FQih7n5FcaPAMbTo3f3h99uRflO2tatsIQz2qDPeKfQXFxN1U4rtDYjvK93N+dI5eEeIztUXxl2kHS1maxh1Ck6LUbSGOn/8rYzx0b9M9Pnr9x+6XSHV0vpjrL8PJdVffYs38nAGpjF9w3sBNh6gwuilkGqNXuj84HL3F7YGHAwuVI/cJT39JU2Co+HF7/xJZRAjx9wBAABsGBPNfZy9xwd/RbinVle1itRz7vGlLWtd2NO3BNy/jHTMDuYOAAAwPJj4EtP8k3HOSZV17RJpTz9P3BOcW7/aOf15yu/FBnMHAAAYNowz97sXu0xa6/3p4Sj3lGpZb79coWwRdkUVNn1zgjWJ/EtTwdwBAACGGePM/TmHayuZaWmVbR3SXrlCKevtd0up+uRw1GOrPXE2HgBzBwAAGB6M2M/9pe2Bmzwy40q4ku5+Wa+8nCv6J4bz1bHYcfYedy4k3WwAzB0AAGD4wTL3++3cZmwL2OyVlVLRplSqevoVJY2Cs6yy57dcu2sx7oAdzB0AAGDYwDL3Dw9EnInllHGF0h55T7+itEmw1z/v+S3X7l3qNspIZwdzBwAAGAaozH30QudHV3l87hhzOppTzhX29CvaRN0JnJYtnlmv7g65a7GLCc4O5g4AADAMkJr7HQuuPL7G69Mj0R5p12t5EsWAskPaG1XUtNE947HVniZ4Opg7AADAsEFs7ncsuHLvUrcF55Jii5tbhN198oEOae+VpMr5TnGPrfa8c5ERj0/B3AEAAIYfAnO/e7HLUxt8l19ODcyp50t65ANKWa+c0yw8Gl684GzS+39FUOv1vaHTKN9msnaVAQAARj4E5j525dWPD0WlVbZJevrViTqkvbm1fNeUqrOxZbTaH1iw8FzyOHsPMHcAAABrQWDuk9d5/3ImsbJVNKBUqhPJB5RdffIOaW+7uIdWubUdp6M5T673AXMHAACwFkTfxLTG8zPHaJ+MmuTyVhPkk1G7w+f2+SYmAAAAW4T4O1Snbb628FzSWpd0E7TwXNJHt9F3qAIAANgiBOZ+xwLne5a4PmLvMX61pwkaZ+/xgJ37HQtIV9RYu8oAAAAjHxP3c4elkAAAALYMmDsAAMAIBMwdAABgBALmDgAAMAIBc7+N4aTaM5utHQQefA4b/4vubaReRsUMYCNgcaqtHcMtAZi7teFznBiX7A3lwBEMTYHVTK1SbMEEqeGkqkMNpDNKG6oXdsyAMTQHDl7fVDB3HMDcbQEJ20HXjwbdYWg7cTXT2iaIS3OgMUZpG/UyLmYboznQ+g1IAifVjPvChus1BJho7qMXOv9rqevDK66Os/cYZ+9x/zK3MdhbRVq7yjaIgbmjQX93YkmGrlTbMEEcwNyHFz7HyfoNSII55m7L9RoCTDT3cfYeL+8Imu8Ub3cpdenFlPf2h09aS7rfAJg7HUTmrp6uGcq+aBsmiAOY+7AiYAXbQAOSYIa523S9hgDjzP2+ZW7/3uT3vzOJe6/lXU6oCMlriC3hxhQ3e6RdPxRSuORC8nMO/vctcwNzNxJSc4eRO0IIzH1YGfpRhVmYbO42Xq8hwDhz//cmv6UXUxLLWtolPYoBZXefoqtP3t2nUAwoxd19ubX81c7p07cE3LmQaorG2lW2QUinZQzcQcJ2uPnYUOe32g/xtB/SkvdmShPUKYj82aBOMpI/ReQx45alMUrNIzWqB8505k4bDybUdceMmbLuN66p9rk3nxvr1NEC10vACiZ4sI9xyUyNGRPdBiQwd5q6Y9cLsw1vGYwz9/+dSUwsa+mQ9nb1yjskPUUNnTk1/KKGTr6kp7tPLu3pL2sWbvbMGr/Kk8LfrV1lG4Tkgar+naA3GGwO1E/THMi4FMhM1TIRCduB1AdJTZBgjEM0DtVLRvxRgy5mrLKaAxmXAlkcp5t3tUn1wokHE/q637gWejEbXXeE1PbkwBHc/K3ahm7kbMnrhRD9X0esNqSJGRO9J0+DoxatTLDbkKZexuRzq4Br7nctdnlqg++hkEKeuFsg64spat7tl2t/JW3pxRR7Ztpuv9yIgsZ2SU9Xr9ybXTPPMfrB5bArJD76QwayYYX+QU6qPSOYzdf8vznQcHjI5zgZ29eJPjQYJDa0V+IjNDFjlaUeu+n6ggn1wmpDHHDqTnAtbviddtG0db95IptJEqfFrhdVDNpn4bQh92QcMgAAB1ZJREFUTcxYEP3Z0Bu5Y7chxXFj87lVwDX3B5e7z3OM9sus7elXlDUL17mx713qdseCK4wbX7i69GJKcnmrtKc/p5b/x7W8ieTPV61dZRtEe0zXHEg4nuJrj1s16CUmHGsQzfkghPD6rs5HWoPPFrplGZgFVswYZRGfImE7GDnwNDIeUnDqTngtyOeLyet+87c4o0izrtcN6Ea4WG2IHzMphH93TW1DhG3WtPncKuCa+zh7D7tLKbElzXxJ74X48o8ORaqdXa07Flx5zsF/tXN6PV9a3Sa+GF8xdYMvmDs2Ov4rYAUbdl+yeUPd/kf8QbKaado9rJO5XmLCIPXAi5m+LEv90cKNhw6cuuOaO33db5RI/VKbJa6XBoqOgd+G9DHTQRyzqW1IcdzYfG4VcM390VWea5zTEzktzYKuLV5ZM7YF6CW4b5nbe/vDK1pE9Xypa3LVUxvB3PHR9SmiCQfTDcUEcydaV2CqudPFjFEWlbkbUy+jDI4Ci5k7Vt1vlEhhlBa6XtQxGJvPMJk7dhtSHDc2n1sFo829ni9dejHZcGA+ZpHz7F3BnGZhbbvUOanqKRi5G4H+INTQjgWsYIypYcuYezWT4MGXqeZOEzNOWRYduZszBaydjwXMHa/uN0qkXh1kietFHYNWPlhtODzmjt+GFMeNzedWwWLmPmmt14+n42t4ksoW8dnYsinwBdlGQLxaxnCFGd0MpkVMkHhErJ+Y7DkknxOomXuljxmvLOJ6kc6VG/Wg2BRw6k5v7ph1R4jGKC13vShj0MoHe/bfzP2R6OfcjWhDiuPG5nOrYLS5i7r6gnLqT0SW7L2Wp60TkSWBOfXCrj6+pDfzevtx3QQb3DNe3hH00Ap3MHciDP0X5whCCAlYqXqrZfT9jvxuNMvcSby1Wmd1BG3MZpRFvsqF5h6maUMccOpuY+aOFTPJuRyOMdcUJ2ZMCGLWHWKbZ+4364WZD4fJYDAYzFtleaTR5m5aMdrjfctWYERAcMMQfP41mBYUsIIN11YTrAum+ChK/uDRYHGxOrHW1ksGu99UMw3sgy5mvLIG66W3tppsiYtRU6sGbYgHfd3pp2Vw25nOKC15vQjibA4kWlxL24aWMHf9P+ECVrCTQ7D2WmH8NqSuF1Y+am9nMBxYZk/tDQtg7tZGZ8tfgydF+haG9Vak9pIG4il4nKUOelENvnmoN9DTenvQ1LdYMcpS3100b5bi1AsnHmzI6679lqb20guDxDR1185HIyLHtOj10ouWcKaevA2xY8ZFK0MnlgRxUilfrKWoO029MPJRu/ut4u3Y5n7vUrfX9oQsvZiyP7DABG3yyJq1M+ihFVfB3IeSW/6dOgAALAXs5z6SAHMHAGAQMPeRgs7HYfiqGgC43cGflnGdszt40flkvUUyhlrvlvH1cdbDK66CueNA/LIfCASyJVnbJ0zB8g9U4Q1VAAAAqwPmDgAAMAKx2GoZ38zaihZRT78irpS74nLqo6s8wNwBAACshcUeqH50KPJiQjlf0uOeWv3mH6EUX7Zn7SoDAACMfCxm7g/YuX94ILKiRZRX27EvIH/SWm8wdwAAAGthMXMfvdB51s4gTrMQ9nMHAACwOkaY+50Lne9e7HLvUlcDud1v5/bEb95fHYutbhPDlr8AAABWB9fc71zoPH6V53Ob/V/dHayn1/eGfPBX+FoXtld6TaesF7b8BQAAsDq45n6/nduHByK3emU7J1fqySW5yjP9eiKn5TpPIunujy5qgtUyAAAA1sWI71BdwUyNKmzq6pMTStzd3ybqLmkU/BmY/+K2gH8tcQVzBwAAsBa45v7wiqvfO8WfZ5Xn1PAJFVXY9E8M53un+Oc2+/9rieuoBaRZWbvKAAAAIx9cc797ieu0zdc+d4xZejGFUD+civ/gr4iJa73uJh+zg7kDAAAMD0YvhRy14Mo9S1wfWXl10m/eU9b7TN3gO2W9z6TfvB9ZefUeygE7mDsAAMCwYbS537PEdca2gAXnkhzDii4lVLgkVV1KqHAMK1pwLmnGtoB76IbtYO4AAADDgHHmPmG154cHIo+GF0cWNhU1dl5vk9S1S6/zJMWNnZGFTcciiucejJywxgvMHQAAwLoY9xLT+39FOEWV8sQ9ffIBUVcfV9jV0CFr6pR1ynp7+xXt4p5T0Zy5ByOp52esXWUAAICRj3EvMe31z+OJe+QKZW27NDi3YZdfrv2VtPVubPfU6ooWkXxAyRP3HIsooZ6fsXaVAQAARj645v7gcvd5R6L9Mmv75AN17dKL8RXfnoybtTPo35v8pm2+9rljtGNYUU4Nv6tXHlXUtPBc0iP28BITAACA1cA198fXeO3xz8up4Qu7+gJz6r8+ztJL8PrekIPBhS3C7uJGwd9hRZPXwa6QAAAAVgPX3J9c73Mhrry6VdzUKdt4NXP6lmt6CcauvPrZkeiqVnENT8JMgF0hAQAArAmuuU/d4OuSVFXXLq3hSeY7xRkuidFs+QtfswcAAGB1/h964JNSYlns2wAAAABJRU5ErkJggg==" alt="" />

这种字符类型,要求内容中不能有标签闭合的字符:

http://www.w3.org/TR/html-markup/syntax.html#replaceable-character-data

must not contain any occurrences of the string "</" followed by characters that are a case-insensitive match for the tag name of the element containing the replaceable character data (for example, "</title" or "</textarea"), followed by a space character, ">", or "/".

textarea 防XSS攻击方法

对于法1 需要实施HTML转码,将</sss>转换为 &lt;

<textarea><%=encodeHTML(serverString);%></textarea>

对于法2 需要实施JS转码

textareaDom.value = "<%=encodeJS(serverString);%>"

如果您的后台不支持转码,可以使用法2+ajax获取方式:

1、 将显示的数据存储为后台文件(logstr.txt), 例如文件内容为,含有攻击脚本,使用法1会构成XSS攻击:

        </textarea>
            <div>aa</div>
            <script>alert("aa")</script>

2、使用ajax获取此文件内容, 后调用法2接口给textarea赋值。

<html>
<head>
<script src="./jquery.js"></script>
</head>
<body>
<textarea id="test">
</textarea>
<script type="text/javascript"> $.get("./logstr.txt", {Action:"get",Name:"lulu"}, function (data, textStatus){
document.getElementById("test").value = data;
}); </script>
</body>
</html>