lixin-wei / hznuoj

Hangzhou Normal University Online Judge

About Me 🌱

• 🔭 Expertise: Building frameworks for large-scale data processing.
• 📫 Feel free to reach me for any questions/opportunities.
  • LinkedIn: https://www.linkedin.com/in/lixin-wei/
  • Email: [email protected]

hznuoj's Issues

docker镜像里面无法上传测试数据

docker镜像里面无法上传测试数据，提示上传失败
添加题目的时候有添加sample data，但test data里面没看到in和out的文件
请问下怎么解决，是哪个文件夹权限的问题吗？

测试python3 代码中不支持中文

input("测试")
UnicodeEncodeError: 'ascii' codec can't encode characters in position 0-1: ordinal not in

Strict filtering of SQL statements causes xss injection

description

The code problem occurred in OJ / admin-tools / cal_scores.php. The $ realname in the output form was obtained from the database. There was no filtering of angle brackets “<>” during registration, which caused the reorganization here. xss injection

Attack process

首先注册一个账号,Class为"软工163"，Real Name is 
<details open ontoggle=['yds_is_so_handsome'].find(\u0070rompt)>

Then visit / OJ / admin-tools / cal_scores.php, set the classList to soft 软工163, and click submit

the attack works

poc

<details open ontoggle=['yds_is_so_handsome'].find(\u0070rompt)>

Insufficient SQL filtering results in xss injection

description

The code problem occurred in OJ / admin-tools / cal_scores.php. The $ realname in the output form was obtained from the database. There was no filtering of angle brackets “<>” during registration, which caused the reorganization here. xss injection

Attack process

首先注册一个账号,Class为"软工163"，Real Name is 
<details open ontoggle=['yds_is_so_handsome'].find(\u0070rompt)>

Then visit / OJ / admin-tools / cal_scores.php, set the classList to soft 软工163, and click submit

the attack works

poc

<details open ontoggle=['yds_is_so_handsome'].find(\u0070rompt)>

Strict SQL filtering leads to xss injection vulnerability

description

The code problem occurred in OJ / admin-tools / cal_scores.php. The $ realname in the output form was obtained from the database. There was no filtering of angle brackets “<>” during registration, which caused the reorganization here. xss injection

Attack process

First register an account on the /OJ/modifypage.php page,Class is "软工163"，Real Name is 
<details open ontoggle=['yds_is_so_handsome'].find(\u0070rompt)>

Then visit / OJ / admin-tools / cal_scores.php, set the classList to soft 软工163, and click submit

the attack works

poc

<details open ontoggle=['yds_is_so_handsome'].find(\u0070rompt)>

打个招呼2333

我是诸振宇
23333

希望能够增加针对不同用户组的成员是否显示 sample input/output 的选项

加上这个选项应该能够减少投机取巧的情况出现。

部署时提示找不到镜像文件

输入docker load -i hznuoj2.1.tar后，提示open hznuoj2.1.tar: no such file or directory

是否可以考虑创建一个 DOCKER 镜像

因为正常安装总会出现各种问题，如果使用 docker 可以增加移植性