From 0991dae3fc465b222fce0b617602faaa477eca3f Mon Sep 17 00:00:00 2001
From: k4n5ha0 <9199771@qq.com>
Date: Wed, 4 Jan 2023 11:01:52 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E6=96=87=E4=BB=B6=E5=90=8D?=
 =?UTF-8?q?=E6=9C=AB=E5=B0=BE=E5=8A=A0=E6=96=9C=E6=9D=A0=E6=88=96=E5=8F=8D?=
 =?UTF-8?q?=E6=96=9C=E6=9D=A0=E7=9A=84=E6=8A=80=E5=B7=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

防止文件名最后的字符为斜杠或反斜杠的绕过技巧
---
 plugins/official/plugin.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/official/plugin.js b/plugins/official/plugin.js
index 1827747b7..8495c643d 100644
--- a/plugins/official/plugin.js
+++ b/plugins/official/plugin.js
@@ -738,7 +738,7 @@ var forcefulBrowsing = {
 var headerInjection = ["user-agent", "referer", "x-forwarded-for"]
 
 // 如果你配置了非常规的扩展名映射，比如让 .abc 当做PHP脚本执行，那你可能需要增加更多扩展名
-var scriptFileRegex = /\.(aspx?|jspx?|php[345]?|phar|phtml|sh|py|pl|rb|so|dll|dylib)\.?$/i
+var scriptFileRegex = /\.(aspx?|jspx?|php[345]?|phar|phtml|sh|py|pl|rb|so|dll|dylib)\.?[\\\/]*$/i
 
 // 正常文件
 var cleanFileRegex  = /\.(jpg|jpeg|png|gif|bmp|txt|rar|zip)$/i