diff options
| author | thomascube <thomas@roundcube.net> | 2009-03-02 14:46:12 +0000 |
|---|---|---|
| committer | thomascube <thomas@roundcube.net> | 2009-03-02 14:46:12 +0000 |
| commit | 63d4b1217216f3d04894090026ed3f01aba9b385 (patch) | |
| tree | f951e8fa1431f6dd27e255685b64628e3c49f271 /tests/src/BID-26800.txt | |
| parent | f54a3a6d41e5700c45120091a57f2c73b804ae25 (diff) | |
Create some basic unit tests based in simpletest.org
Diffstat (limited to 'tests/src/BID-26800.txt')
| -rw-r--r-- | tests/src/BID-26800.txt | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/tests/src/BID-26800.txt b/tests/src/BID-26800.txt new file mode 100644 index 000000000..513516c09 --- /dev/null +++ b/tests/src/BID-26800.txt @@ -0,0 +1,52 @@ +<html> +<head> +</head> +<body> +<h1>1 test</h1> +<p><style> block</p> +<style>input { left:expression( alert('expression!') ) }</style> +<style>div { background:url(alert('URL!') ) }</style> + +<h1>2 test</h1> +<p><div> block</p> +<div style="font-style:italic">valid css</div> +<div style="{ left:expression( alert('expression!') ) }"> +<div style="{ background:url( alert('URL!') ) }"> + +<h1>3 test</h1> +<p>Inject comment text</p> +<div style="{ left:exp/* */ression( alert('xss3') ) }"> +<div style="{ background:u/* */rl( alert('xssurl3') ) }"> + +<h1>4 test</h1> +<p>Using reverse solid to directe the codepoint</p> +<div style="{ left:\0065\0078pression( alert('xss4') ) }"> +<div style="{ background:\0075rl( alert('xssurl4') ) }"> + +<h1>5 test</h1> +<p>Character entity references</p> +<p>Character entity references is acceptable in "inline styles"</p> +<div style="{ left:expression( alert('xss') ) }"> +<div style="{ left:expression( alert('xss') ) }"> +<div style="{ background:url( alert('URL!') ) }"> +<div style="{ background:url( alert('URL!') ) }"> +<div style="{ left:expression( alert('xss') ) }"> + +<div style="{ left:..ｐ.....ｏ.( alert('xss') ) }"> +<div style="{ left:../**/pression( alert('xss') ) }"> +<div style="{ left:expʀessioɴ( alert('xss') ) }"> +<div style="{ left:\0065\0078pression( alert('xss') ) }"> +<div style="{ left:ex p ression( alert('xss') ) }"> + +<div style="{ background:...( javascript:alert('xss') ) }"> +<div style="{ background:u/**/rl( javascript:alert('xss') ) }"> +<div style="{ background:\0075\0072\006c( javascript:alert('xss') ) }"> +<div style="{ background:uʀʟ( javascript:alert('xss') ) +}"> +<div style="{ background:\0075\0280l( javascript:alert('xss') +) }"> +<div style="{ background:u r l( javascript:alert('xss') ) }"> + +</body> +</html> + |