| commit | author | age | ||
| 63d4b1 | 1 | <html> |
| T | 2 | <head> |
| 3 | </head> | |
| 4 | <body> | |
| 5 | <h1>1 test</h1> | |
| 6 | <p><style> block</p> | |
| 7 | <style>input { left:expression( alert('expression!') ) }</style> | |
| 8 | <style>div { background:url(alert('URL!') ) }</style> | |
| 9 | ||
| 10 | <h1>2 test</h1> | |
| 11 | <p><div> block</p> | |
| 12 | <div style="font-style:italic">valid css</div> | |
| 13 | <div style="{ left:expression( alert('expression!') ) }"> | |
| 14 | <div style="{ background:url( alert('URL!') ) }"> | |
| 15 | ||
| 16 | <h1>3 test</h1> | |
| 17 | <p>Inject comment text</p> | |
| 18 | <div style="{ left:exp/* */ression( alert('xss3') ) }"> | |
| 19 | <div style="{ background:u/* */rl( alert('xssurl3') ) }"> | |
| 20 | ||
| 21 | <h1>4 test</h1> | |
| 22 | <p>Using reverse solid to directe the codepoint</p> | |
| 23 | <div style="{ left:\0065\0078pression( alert('xss4') ) }"> | |
| 24 | <div style="{ background:\0075rl( alert('xssurl4') ) }"> | |
| 25 | ||
| 26 | <h1>5 test</h1> | |
| 27 | <p>Character entity references</p> | |
| 28 | <p>Character entity references is acceptable in "inline styles"</p> | |
| 29 | <div style="{ left:expression( alert('xss') ) }"> | |
| 30 | <div style="{ left:expression( alert('xss') ) }"> | |
| 31 | <div style="{ background:url( alert('URL!') ) }"> | |
| 32 | <div style="{ background:url( alert('URL!') ) }"> | |
| 33 | <div style="{ left:expression( alert('xss') ) }"> | |
| 34 | ||
| 35 | <div style="{ left:ï½.ï½.ï½ï½.ï½.ï½.ï½.ï½.ï½ï½.( alert('xss') ) }"> | |
| 36 | <div style="{ left:ï½.ï½./**/pression( alert('xss') ) }"> | |
| 37 | <div style="{ left:expʀessioɴ( alert('xss') ) }"> | |
| 38 | <div style="{ left:\0065\0078pression( alert('xss') ) }"> | |
| 39 | <div style="{ left:ex p ression( alert('xss') ) }"> | |
| 40 | ||
| 41 | <div style="{ background:ï½.ï½.ï½.( javascript:alert('xss') ) }"> | |
| 42 | <div style="{ background:u/**/rl( javascript:alert('xss') ) }"> | |
| 43 | <div style="{ background:\0075\0072\006c( javascript:alert('xss') ) }"> | |
| 44 | <div style="{ background:uʀʟ( javascript:alert('xss') ) | |
| 45 | }"> | |
| 46 | <div style="{ background:\0075\0280l( javascript:alert('xss') | |
| 47 | ) }"> | |
| 48 | <div style="{ background:u r l( javascript:alert('xss') ) }"> | |
| 49 | ||
| 50 | </body> | |
| 51 | </html> | |
| 52 | ||
