如何使用JavaScript解码base64编码的文件

My company has a very strict intranet for work related, the net has a single doorway to allow files in and out. The doorway's security does not allow special kinds of files (*.txt, *.doc etc only), and even in those specific kinds of files, it searches for patterns that approve that the file is really that kind. (You can't simply disguise a *.zip file as a *.doc file.)

我的公司有一个非常严格的内联网工作相关，网络有一个单一的门口允许文件进出。门口的安全性不允许使用特殊类型的文件（仅限* .txt，* .doc等），即使在这些特定类型的文件中，它也会搜索批准文件真正属于那种类型的模式。（您不能简单地将* .zip文件伪装成* .doc文件。）

As a security project, I was told to find a way to bypass this system, and insert a single C language .exe file that says 'Hello World'.

作为一个安全项目，我被告知找到绕过这个系统的方法，并插入一个单词C语言.exe文件，说“Hello World”。

What I thought was to change the extension to .txt, and base64 encode it so that it would be more acceptable for the system. The problem is, how to decode it once it's in. It's very easy on the outside, PHP or any other decent language can do it for me. However, in there, the only real language I have access to is JavaScript (on IE6 and maybe, MAYBE, on IE8).

我认为将扩展名更改为.txt，而base64对其进行编码，以便系统更容易接受。问题是，如果它进入后如何解码它。在外面非常容易，PHP或任何其他体面的语言可以为我做。但是，在那里，我可以访问的唯一真正的语言是JavaScript（在IE6上，也许，MAYBE，在IE8上）。

So the question is as follows, can I use JavaScript to read a file from the file system, decode it, and write it back? or at least display the result for me?

所以问题如下，我可以使用JavaScript从文件系统中读取文件，解码并将其写回来吗？或者至少为我显示结果？

Note that I don't ask for decoding/encoding a message, this one is easy, I look to decode encode a file.

请注意，我不要求解码/编码消息，这一个很容易，我期待解码编码文件。

Thanks.

谢谢。

5 个解决方案

#1

JSON might be the answer you are looking for. It can actually do the trick.

JSON可能是您正在寻找的答案。它实际上可以做到这一点。

Encode your txt file in JSON format. It is very likely for it to pass your company's doorway security

以JSON格式对txt文件进行编码。它很可能通过贵公司的门口安检
```
var myJsonData = { "text" : "SGVsbG8sIHdvcmxkIQ==" };  // <-- base64 for "Hello, world!"
```
Import your txt file using plain html script syntax

使用普通的html脚本语法导入您的txt文件
```
<script src="hello.txt" type="text/javascript"> </script>
```
That's it! Now you can access a JSON object using the Syntax:

而已！现在，您可以使用语法访问JSON对象：
```
alert(myJsonData.text);
```
To complete your job, get this simple Javascript base64 decoder.

要完成您的工作，请使用这个简单的Javascript base64解码器。

You're done. Here's the (very simple) code I've used:

你完成了。这是我用过的（非常简单的）代码：

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
  <meta http-equiv="content-type" content="text/html; charset=windows-1250">
  <meta name="generator" content="PSPad editor, www.pspad.com">
  <title></title>

  <script src="base64utils.js" type="text/javascript"> </script>
  <script src="hello.txt" type="text/javascript"> </script>

  <script type="text/javascript">
    function helloFunction() {
    document.getElementById("hello").innerHTML = decode64(myJsonData.text);
    }
  </script>

  </head>
  <body onload="helloFunction();">
    <p id="hello"></p>
  </body>
</html>

#2

Using only javascript (i.e. no plugins like AIR etc), browsers don't allow access to the file system. Not only is it not possible to write a file to the disk, it's not possible to even read it - browsers are very strict on that sort of thing, thank goodness.

仅使用javascript（即没有像AIR等插件），浏览器不允许访问文件系统。不仅不可能将文件写入磁盘，甚至无法读取它 - 浏览器对此类事情非常严格，谢天谢地。

#3

You cannot do this with straight JS in the browser, security context and the DOM do not allow filesystem access.

你不能在浏览器中直接使用JS，安全上下文和DOM不允许文件系统访问。

You cannot do this with current versions of flash, older versions (pre 7 IIRC) had some security flaws that allowed filesystem access.

对于当前版本的闪存，你不能这样做，旧版本（pre 7 IIRC）有一些允许文件系统访问的安全漏洞。

You could do this with a custom plugin, and possibly a signed Java applet, or COM (ActiveX component, IE only).

您可以使用自定义插件，可能是签名的Java小程序或COM（ActiveX组件，仅IE）。

I would suggest working with IT regarding your intranet to open up the context/permissions needed in this case as that may be the shortest path to what you are wanting here. Alternative, you could create a command-line utility to easily encrypt/decrypt given files signed by a common key.

我建议与IT部门合作开发内部网以打开本案例所需的上下文/权限，因为这可能是您在此处所需的最短路径。或者，您可以创建一个命令行实用程序，以便轻松加密/解密由公用密钥签名的给定文件。

#4

It all depends on how you can get the file in. If you have the base-64 encoded exe as a .txt, you could easily use Flash! I'm not quite sure how you would implement this, but you can load a file into flash and as3 using flex.

这一切都取决于你如何获取文件。如果你有base-64编码的exe作为.txt，你可以很容易地使用Flash！我不太确定你将如何实现它，但你可以使用flex将文件加载到flash和as3中。

<?xml version="1.0" encoding="utf-8"?>
<mx:Application xmlns:mx="http://www.adobe.com/2006/mxml" layout="absolute">

    <mx:Script>
        <![CDATA[
            import flash.net.FileReference;
            import flash.net.FileFilter;

            import flash.events.IOErrorEvent;
            import flash.events.Event;

            import flash.utils.ByteArray;

            //FileReference Class well will use to load data
            private var fr:FileReference;

            //File types which we want the user to open
            private static const FILE_TYPES:Array = [new FileFilter("Text File", "*.txt;*.text")];

            //called when the user clicks the load file button
            private function onLoadFileClick():void
            {
                //create the FileReference instance
                fr = new FileReference();

                //listen for when they select a file
                fr.addEventListener(Event.SELECT, onFileSelect);

                //listen for when then cancel out of the browse dialog
                fr.addEventListener(Event.CANCEL,onCancel);

                //open a native browse dialog that filters for text files
                fr.browse(FILE_TYPES);
            }

            /************ Browse Event Handlers **************/

            //called when the user selects a file from the browse dialog
            private function onFileSelect(e:Event):void
            {
                //listen for when the file has loaded
                fr.addEventListener(Event.COMPLETE, onLoadComplete);

                //listen for any errors reading the file
                fr.addEventListener(IOErrorEvent.IO_ERROR, onLoadError);

                //load the content of the file
                fr.load();
            }

            //called when the user cancels out of the browser dialog
            private function onCancel(e:Event):void
            {
                trace("File Browse Canceled");
                fr = null;
            }

            /************ Select Event Handlers **************/

            //called when the file has completed loading
            private function onLoadComplete(e:Event):void
            {
                //get the data from the file as a ByteArray
                var data:ByteArray = fr.data;

                //read the bytes of the file as a string and put it in the
                //textarea
                outputField.text = data.readUTFBytes(data.bytesAvailable);

                //clean up the FileReference instance

                fr = null;
            }

            //called if an error occurs while loading the file contents
            private function onLoadError(e:IOErrorEvent):void
            {
                trace("Error loading file : " + e.text);
            }

        ]]>
    </mx:Script>

    <mx:Button label="Load Text File" right="10" bottom="10" click="onLoadFileClick()"/>
    <mx:TextArea right="10" left="10" top="10" bottom="40" id="outputField"/>

</mx:Application>

To decode it, look into http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/utils/Base64Decoder.html

要解码它，请查看http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/utils/Base64Decoder.html

#5

If the security system scans for patterns in files, it is very unlikely that it will overlook a base64-encoded file or base64-encoded contents in files. E-mail attachments are base64-encoded, and if the system is any good it will scan for potentially harmful e-mail attachments even if they are named .txt. The base64-encoded start of an EXE file is almost certainly recognized by it. So ISTM you are asking the wrong question.

如果安全系统扫描文件中的模式，则它不太可能忽略文件中base64编码的文件或base64编码的内容。电子邮件附件是base64编码的，如果系统有任何好处，它将扫描可能有害的电子邮件附件，即使它们被命名为.txt。几乎可以肯定它识别了一个EXE文件的base64编码的开头。所以ISTM你问的是错误的问题。

#1