@ecency/render-helper 2.2.31 → 2.2.33
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/catch-post-image.js +6 -0
- package/lib/catch-post-image.js.map +1 -1
- package/lib/consts/allowed-attributes.const.js +1 -1
- package/lib/consts/allowed-attributes.const.js.map +1 -1
- package/lib/consts/regexes.const.d.ts +1 -0
- package/lib/consts/regexes.const.js +2 -1
- package/lib/consts/regexes.const.js.map +1 -1
- package/lib/methods/iframe.method.js +6 -0
- package/lib/methods/iframe.method.js.map +1 -1
- package/lib/methods/p.method.d.ts +1 -0
- package/lib/methods/p.method.js +11 -0
- package/lib/methods/p.method.js.map +1 -0
- package/lib/methods/traverse.method.js +4 -0
- package/lib/methods/traverse.method.js.map +1 -1
- package/lib/render-helper.js +1 -1
- package/package.json +1 -1
- package/src/catch-post-image.spec.ts +10 -0
- package/src/catch-post-image.ts +7 -0
- package/src/consts/allowed-attributes.const.ts +1 -1
- package/src/consts/regexes.const.ts +1 -0
- package/src/markdown-2-html.spec.ts +90 -90
- package/src/methods/iframe.method.ts +80 -73
- package/src/methods/p.method.ts +6 -0
- package/src/methods/traverse.method.ts +4 -0
- package/src/test/data/legacy/10.json +1 -1
- package/src/test/data/legacy/21.json +1 -1
- package/src/test/data/legacy/2112524.json +2 -2
- package/src/test/data/legacy/22.json +1 -1
- package/src/test/data/legacy/23.json +1 -1
- package/src/test/data/legacy/25.json +1 -1
- package/src/test/data/legacy/26.json +1 -1
- package/src/test/data/legacy/27.JSON +1 -1
- package/src/test/data/legacy/31.json +1 -1
|
@@ -1,160 +1,167 @@
|
|
|
1
|
-
import { ARCH_REGEX, DAPPLR_REGEX, LBRY_REGEX, TRUVVL_REGEX, ODYSEE_REGEX, BITCHUTE_REGEX, RUMBLE_REGEX, BRIGHTEON_REGEX, VIMEO_EMBED_REGEX, SPEAK_EMBED_REGEX, VIMM_EMBED_REGEX, D_TUBE_EMBED_REGEX, SPOTIFY_EMBED_REGEX, SOUNDCLOUD_EMBED_REGEX, TWITCH_EMBED_REGEX, YOUTUBE_EMBED_REGEX, BRAND_NEW_TUBE_REGEX, LOOM_EMBED_REGEX, AUREAL_EMBED_REGEX } from '../consts'
|
|
1
|
+
import { ARCH_REGEX, DAPPLR_REGEX, LBRY_REGEX, TRUVVL_REGEX, ODYSEE_REGEX, SKATEHIVE_IPFS_REGEX, BITCHUTE_REGEX, RUMBLE_REGEX, BRIGHTEON_REGEX, VIMEO_EMBED_REGEX, SPEAK_EMBED_REGEX, VIMM_EMBED_REGEX, D_TUBE_EMBED_REGEX, SPOTIFY_EMBED_REGEX, SOUNDCLOUD_EMBED_REGEX, TWITCH_EMBED_REGEX, YOUTUBE_EMBED_REGEX, BRAND_NEW_TUBE_REGEX, LOOM_EMBED_REGEX, AUREAL_EMBED_REGEX } from '../consts'
|
|
2
2
|
|
|
3
3
|
export function iframe(el: HTMLElement): void {
|
|
4
|
-
const src = el.getAttribute('src')
|
|
4
|
+
const src = el.getAttribute('src');
|
|
5
5
|
if (!src) {
|
|
6
|
-
el.parentNode.removeChild(el)
|
|
7
|
-
return
|
|
6
|
+
el.parentNode.removeChild(el);
|
|
7
|
+
return;
|
|
8
8
|
}
|
|
9
9
|
|
|
10
10
|
// Youtube
|
|
11
11
|
if (src.match(YOUTUBE_EMBED_REGEX)) {
|
|
12
12
|
// strip query string (yt: autoplay=1,controls=0,showinfo=0, etc)
|
|
13
|
-
const s = src.replace(/\?.+$/, '')
|
|
14
|
-
el.setAttribute('src', s)
|
|
15
|
-
return
|
|
13
|
+
const s = src.replace(/\?.+$/, '');
|
|
14
|
+
el.setAttribute('src', s);
|
|
15
|
+
return;
|
|
16
16
|
}
|
|
17
17
|
|
|
18
18
|
if (src.match(BITCHUTE_REGEX)) {
|
|
19
|
-
return
|
|
19
|
+
return;
|
|
20
20
|
}
|
|
21
21
|
|
|
22
22
|
// Vimeo
|
|
23
|
-
const m = src.match(VIMEO_EMBED_REGEX)
|
|
23
|
+
const m = src.match(VIMEO_EMBED_REGEX);
|
|
24
24
|
if (m && m.length === 2) {
|
|
25
|
-
const s = `https://player.vimeo.com/video/${m[1]}
|
|
26
|
-
el.setAttribute('src', s)
|
|
27
|
-
return
|
|
25
|
+
const s = `https://player.vimeo.com/video/${m[1]}`;
|
|
26
|
+
el.setAttribute('src', s);
|
|
27
|
+
return;
|
|
28
28
|
}
|
|
29
29
|
|
|
30
30
|
// Twitch
|
|
31
31
|
if (src.match(TWITCH_EMBED_REGEX)) {
|
|
32
|
-
const parentDomain = 'ecency.com'
|
|
33
|
-
const s = `${src}&parent=${parentDomain}&autoplay=false
|
|
34
|
-
el.setAttribute('src', s)
|
|
35
|
-
return
|
|
32
|
+
const parentDomain = 'ecency.com';
|
|
33
|
+
const s = `${src}&parent=${parentDomain}&autoplay=false`;
|
|
34
|
+
el.setAttribute('src', s);
|
|
35
|
+
return;
|
|
36
36
|
}
|
|
37
37
|
|
|
38
38
|
// 3Speak
|
|
39
39
|
if (src.match(SPEAK_EMBED_REGEX)) {
|
|
40
|
-
const s = `${src}&autoplay=true
|
|
41
|
-
el.setAttribute('src', s)
|
|
42
|
-
return
|
|
40
|
+
const s = `${src}&autoplay=true`;
|
|
41
|
+
el.setAttribute('src', s);
|
|
42
|
+
return;
|
|
43
43
|
}
|
|
44
44
|
|
|
45
45
|
// Spotify
|
|
46
46
|
if (src.match(SPOTIFY_EMBED_REGEX)) {
|
|
47
|
-
el.setAttribute('src', src)
|
|
48
|
-
el.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups')
|
|
49
|
-
el.setAttribute('frameborder', '0')
|
|
50
|
-
return
|
|
47
|
+
el.setAttribute('src', src);
|
|
48
|
+
el.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups');
|
|
49
|
+
el.setAttribute('frameborder', '0');
|
|
50
|
+
return;
|
|
51
51
|
}
|
|
52
52
|
|
|
53
53
|
// Soundcloud
|
|
54
54
|
if (src.match(SOUNDCLOUD_EMBED_REGEX)) {
|
|
55
|
-
const match = src.match(/url=(.+?)&/)
|
|
55
|
+
const match = src.match(/url=(.+?)&/);
|
|
56
56
|
if (match && match.length === 2) {
|
|
57
|
-
const s = `https://w.soundcloud.com/player/?url=${match[1]}&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&visual=true
|
|
58
|
-
el.setAttribute('src', s)
|
|
59
|
-
return
|
|
57
|
+
const s = `https://w.soundcloud.com/player/?url=${match[1]}&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&visual=true`;
|
|
58
|
+
el.setAttribute('src', s);
|
|
59
|
+
return;
|
|
60
60
|
}
|
|
61
61
|
}
|
|
62
62
|
|
|
63
63
|
// Dtube
|
|
64
64
|
if (src.match(D_TUBE_EMBED_REGEX)) {
|
|
65
|
-
el.setAttribute('src', src)
|
|
66
|
-
el.setAttribute('sandbox', 'allow-scripts allow-same-origin')
|
|
67
|
-
el.setAttribute('frameborder', '0')
|
|
68
|
-
el.setAttribute('allowfullscreen', 'true')
|
|
69
|
-
return
|
|
65
|
+
el.setAttribute('src', src);
|
|
66
|
+
el.setAttribute('sandbox', 'allow-scripts allow-same-origin');
|
|
67
|
+
el.setAttribute('frameborder', '0');
|
|
68
|
+
el.setAttribute('allowfullscreen', 'true');
|
|
69
|
+
return;
|
|
70
70
|
}
|
|
71
71
|
|
|
72
72
|
// VIMM
|
|
73
73
|
if (src.match(VIMM_EMBED_REGEX)) {
|
|
74
|
-
el.setAttribute('src', src)
|
|
75
|
-
el.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups')
|
|
76
|
-
el.setAttribute('frameborder', '0')
|
|
77
|
-
el.setAttribute('allowfullscreen', 'true')
|
|
78
|
-
return
|
|
74
|
+
el.setAttribute('src', src);
|
|
75
|
+
el.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups');
|
|
76
|
+
el.setAttribute('frameborder', '0');
|
|
77
|
+
el.setAttribute('allowfullscreen', 'true');
|
|
78
|
+
return;
|
|
79
79
|
}
|
|
80
80
|
|
|
81
81
|
// Dapplr
|
|
82
82
|
if (src.match(DAPPLR_REGEX)) {
|
|
83
|
-
el.setAttribute('src', src)
|
|
84
|
-
el.setAttribute('sandbox', 'allow-scripts allow-same-origin')
|
|
85
|
-
el.setAttribute('frameborder', '0')
|
|
86
|
-
el.setAttribute('allowfullscreen', 'true')
|
|
87
|
-
return
|
|
83
|
+
el.setAttribute('src', src);
|
|
84
|
+
el.setAttribute('sandbox', 'allow-scripts allow-same-origin');
|
|
85
|
+
el.setAttribute('frameborder', '0');
|
|
86
|
+
el.setAttribute('allowfullscreen', 'true');
|
|
87
|
+
return;
|
|
88
88
|
}
|
|
89
89
|
|
|
90
90
|
// Truvvl
|
|
91
91
|
if (src.match(TRUVVL_REGEX)) {
|
|
92
|
-
el.setAttribute('src', src)
|
|
93
|
-
el.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups')
|
|
94
|
-
el.setAttribute('frameborder', '0')
|
|
95
|
-
el.setAttribute('class', 'portrait-embed')
|
|
96
|
-
el.setAttribute('allowfullscreen', 'true')
|
|
97
|
-
return
|
|
92
|
+
el.setAttribute('src', src);
|
|
93
|
+
el.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups');
|
|
94
|
+
el.setAttribute('frameborder', '0');
|
|
95
|
+
el.setAttribute('class', 'portrait-embed');
|
|
96
|
+
el.setAttribute('allowfullscreen', 'true');
|
|
97
|
+
return;
|
|
98
98
|
}
|
|
99
99
|
|
|
100
100
|
// LBRY.tv
|
|
101
101
|
if (src.match(LBRY_REGEX)) {
|
|
102
|
-
el.setAttribute('src', src)
|
|
103
|
-
el.setAttribute('frameborder', '0')
|
|
104
|
-
return
|
|
102
|
+
el.setAttribute('src', src);
|
|
103
|
+
el.setAttribute('frameborder', '0');
|
|
104
|
+
return;
|
|
105
105
|
}
|
|
106
106
|
|
|
107
107
|
// ODYSEE
|
|
108
108
|
if (src.match(ODYSEE_REGEX)) {
|
|
109
|
-
el.setAttribute('src', src)
|
|
110
|
-
el.setAttribute('frameborder', '0')
|
|
111
|
-
return
|
|
109
|
+
el.setAttribute('src', src);
|
|
110
|
+
el.setAttribute('frameborder', '0');
|
|
111
|
+
return;
|
|
112
|
+
}
|
|
113
|
+
|
|
114
|
+
// IPFS Skatehive
|
|
115
|
+
if (src.match(SKATEHIVE_IPFS_REGEX)) {
|
|
116
|
+
el.setAttribute('src', src);
|
|
117
|
+
el.setAttribute('allowfullscreen', 'true');
|
|
118
|
+
return;
|
|
112
119
|
}
|
|
113
120
|
|
|
114
121
|
// archive.org
|
|
115
122
|
if (src.match(ARCH_REGEX)) {
|
|
116
|
-
el.setAttribute('src', src)
|
|
117
|
-
return
|
|
123
|
+
el.setAttribute('src', src);
|
|
124
|
+
return;
|
|
118
125
|
}
|
|
119
126
|
|
|
120
127
|
// Rumble
|
|
121
128
|
if (src.match(RUMBLE_REGEX)) {
|
|
122
|
-
el.setAttribute('src', src)
|
|
123
|
-
el.setAttribute('frameborder', '0')
|
|
124
|
-
return
|
|
129
|
+
el.setAttribute('src', src);
|
|
130
|
+
el.setAttribute('frameborder', '0');
|
|
131
|
+
return;
|
|
125
132
|
}
|
|
126
133
|
|
|
127
134
|
// Brigtheon
|
|
128
135
|
if (src.match(BRIGHTEON_REGEX)) {
|
|
129
|
-
el.setAttribute('src', src)
|
|
130
|
-
el.setAttribute('frameborder', '0')
|
|
131
|
-
return
|
|
136
|
+
el.setAttribute('src', src);
|
|
137
|
+
el.setAttribute('frameborder', '0');
|
|
138
|
+
return;
|
|
132
139
|
}
|
|
133
140
|
|
|
134
141
|
// Brandnew Tube
|
|
135
142
|
if (src.match(BRAND_NEW_TUBE_REGEX)) {
|
|
136
|
-
el.setAttribute('src', src)
|
|
137
|
-
el.setAttribute('frameborder', '0')
|
|
143
|
+
el.setAttribute('src', src);
|
|
144
|
+
el.setAttribute('frameborder', '0');
|
|
138
145
|
return;
|
|
139
146
|
}
|
|
140
147
|
|
|
141
148
|
// Loom
|
|
142
149
|
if (src.match(LOOM_EMBED_REGEX)) {
|
|
143
|
-
el.setAttribute('src', src)
|
|
144
|
-
el.setAttribute('frameborder', '0')
|
|
150
|
+
el.setAttribute('src', src);
|
|
151
|
+
el.setAttribute('frameborder', '0');
|
|
145
152
|
return;
|
|
146
153
|
}
|
|
147
154
|
|
|
148
155
|
// Aureal
|
|
149
156
|
if (src.match(AUREAL_EMBED_REGEX)) {
|
|
150
|
-
el.setAttribute('src', src)
|
|
151
|
-
el.setAttribute('frameborder', '0')
|
|
157
|
+
el.setAttribute('src', src);
|
|
158
|
+
el.setAttribute('frameborder', '0');
|
|
152
159
|
return;
|
|
153
160
|
}
|
|
154
161
|
|
|
155
|
-
const replaceNode = el.ownerDocument.createElement('div')
|
|
156
|
-
replaceNode.setAttribute('class', 'unsupported-iframe')
|
|
157
|
-
replaceNode.textContent = `(Unsupported ${src})
|
|
158
|
-
el.parentNode.insertBefore(replaceNode, el)
|
|
159
|
-
el.parentNode.removeChild(el)
|
|
162
|
+
const replaceNode = el.ownerDocument.createElement('div');
|
|
163
|
+
replaceNode.setAttribute('class', 'unsupported-iframe');
|
|
164
|
+
replaceNode.textContent = `(Unsupported ${src})`;
|
|
165
|
+
el.parentNode.insertBefore(replaceNode, el);
|
|
166
|
+
el.parentNode.removeChild(el);
|
|
160
167
|
}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { a } from './a.method'
|
|
2
2
|
import { iframe } from './iframe.method'
|
|
3
3
|
import { img } from './img.method'
|
|
4
|
+
import { p } from './p.method'
|
|
4
5
|
import { text } from './text.method'
|
|
5
6
|
|
|
6
7
|
export function traverse(node: Node, forApp: boolean, depth = 0, webp = false): void {
|
|
@@ -23,6 +24,9 @@ export function traverse(node: Node, forApp: boolean, depth = 0, webp = false):
|
|
|
23
24
|
if (child.nodeName.toLowerCase() === 'img') {
|
|
24
25
|
img(<HTMLElement>child, webp)
|
|
25
26
|
}
|
|
27
|
+
if (child.nodeName.toLowerCase() === 'p') {
|
|
28
|
+
p(<HTMLElement>child)
|
|
29
|
+
}
|
|
26
30
|
|
|
27
31
|
traverse(child, forApp, depth + 1, webp)
|
|
28
32
|
})
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 10,
|
|
3
3
|
"input": "Lorem ipsum dolor <img src=x onerror=alert(x)> sit amet.\n\n<a href=\"javascript:void(0)\">etiam ut sollicitudin neque</a>\n\n<a onclick=\"console.log('ss')\">Vivamus pulvinar semper porttitor</a>",
|
|
4
|
-
"result": "<p>Lorem ipsum dolor <img src=\"https://images.ecency.com/p/35.png?format=match&mode=fit\" /> sit amet.</p>\n<p><a>etiam ut sollicitudin neque</a></p>\n<p><a>Vivamus pulvinar semper porttitor</a></p>"
|
|
4
|
+
"result": "<p dir=\"auto\">Lorem ipsum dolor <img src=\"https://images.ecency.com/p/35.png?format=match&mode=fit\" /> sit amet.</p>\n<p dir=\"auto\"><a>etiam ut sollicitudin neque</a></p>\n<p dir=\"auto\"><a>Vivamus pulvinar semper porttitor</a></p>"
|
|
5
5
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 21,
|
|
3
3
|
"input": "javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/\"/+/onmouseover=1/+/[*/[]/+alert(1)//'>\n\n<IMG SRC=\"javascript:alert('XSS');\"><img src=\"javascript:alert('XSS');\">\n\n<IMG SRC=javascript:alert('XSS')> <img src=javascript:alert('XSS')>",
|
|
4
|
-
"result": "<p>javascript:/<em>--><svg/onload='+/\"/+/onmouseover=1/+/[</em>/[]/+alert(1)//'></p>\n<p><img /><img /></p>\n<p><IMG SRC=javascript:alert('XSS')> <img src=javascript:alert('XSS')></p>"
|
|
4
|
+
"result": "<p dir=\"auto\">javascript:/<em>--><svg/onload='+/\"/+/onmouseover=1/+/[</em>/[]/+alert(1)//'></p>\n<p dir=\"auto\"><img /><img /></p>\n<p dir=\"auto\"><IMG SRC=javascript:alert('XSS')> <img src=javascript:alert('XSS')></p>"
|
|
5
5
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 2112524,
|
|
3
|
-
"input": "What do you think ? With <3 Steemers\n\n\n\n<iframe src=\"https://player.vimeo.com/video/207439341\" width=\"640\" height=\"360\" frameborder=\"0\" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>\n<p><a href=\"https://vimeo.com/207439341\">ShowReel 2017</a> from <a href=\"https://vimeo.com/freerubens\">Rubens Ben</a> on <a href=\"https://vimeo.com\">Vimeo</a>.</p>",
|
|
4
|
-
"result": "<p>What do you think ? With <3 Steemers</p>\n<p><img src=\"https://images.ecency.com/p/6C2W1azD1rBrx31MBKd8RJWSbPhKuu863DJHXqo7MppEjTQsPhXD81k.png?format=match&mode=fit\" alt=\"GitHub Logo\" /></p>\n<iframe src=\"https://player.vimeo.com/video/207439341\" frameborder=\"0\" webkitallowfullscreen=\"webkitallowfullscreen\" mozallowfullscreen=\"mozallowfullscreen\" allowfullscreen=\"allowfullscreen\"></iframe>\n<p><a class=\"markdown-external-link\" data-href=\"https://vimeo.com/207439341\">ShowReel 2017</a> from <a class=\"markdown-external-link\" data-href=\"https://vimeo.com/freerubens\">Rubens Ben</a> on <a class=\"markdown-external-link\" data-href=\"https://vimeo.com\">Vimeo</a>.</p>"
|
|
3
|
+
"input": "What do you think ? With <3 Steemers\n\n\n\n<iframe src=\"https://player.vimeo.com/video/207439341\" width=\"640\" height=\"360\" frameborder=\"0\" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>\n<p dir=\"auto\"><a href=\"https://vimeo.com/207439341\">ShowReel 2017</a> from <a href=\"https://vimeo.com/freerubens\">Rubens Ben</a> on <a href=\"https://vimeo.com\">Vimeo</a>.</p>",
|
|
4
|
+
"result": "<p dir=\"auto\">What do you think ? With <3 Steemers</p>\n<p dir=\"auto\"><img src=\"https://images.ecency.com/p/6C2W1azD1rBrx31MBKd8RJWSbPhKuu863DJHXqo7MppEjTQsPhXD81k.png?format=match&mode=fit\" alt=\"GitHub Logo\" /></p>\n<iframe src=\"https://player.vimeo.com/video/207439341\" frameborder=\"0\" webkitallowfullscreen=\"webkitallowfullscreen\" mozallowfullscreen=\"mozallowfullscreen\" allowfullscreen=\"allowfullscreen\"></iframe>\n<p dir=\"auto\"><a class=\"markdown-external-link\" data-href=\"https://vimeo.com/207439341\">ShowReel 2017</a> from <a class=\"markdown-external-link\" data-href=\"https://vimeo.com/freerubens\">Rubens Ben</a> on <a class=\"markdown-external-link\" data-href=\"https://vimeo.com\">Vimeo</a>.</p>"
|
|
5
5
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 22,
|
|
3
3
|
"input": "<IMG SRC=JaVaScRiPt:alert('XSS')> <IMG SRC=javascript:alert("XSS")>\n<IMG SRC=`javascript:alert(\"RSnake says, 'XSS'\")`>\n<a onmouseover=\"alert(document.cookie)\">xxs link</a><a onmouseover=alert(document.cookie)>xxs link</a>\n<IMG \"\"\"><SCRIPT>alert(\"XSS\")</SCRIPT>\"><IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\n <IMG SRC= onmouseover=\"alert('xxs')\">",
|
|
4
|
-
"result": "<p><IMG SRC=JaVaScRiPt:alert('XSS')> <IMG SRC=javascript:alert("XSS")><br />\n<IMG SRC=<code>javascript:alert(\"RSnake says, 'XSS'\")</code>><br />\n<a>xxs link</a><a>xxs link</a><br />\n<IMG \"\"\">alert("XSS")\"><img /><br />\n<IMG SRC= onmouseover=\"alert('xxs')\"></p>"
|
|
4
|
+
"result": "<p dir=\"auto\"><IMG SRC=JaVaScRiPt:alert('XSS')> <IMG SRC=javascript:alert("XSS")><br />\n<IMG SRC=<code>javascript:alert(\"RSnake says, 'XSS'\")</code>><br />\n<a>xxs link</a><a>xxs link</a><br />\n<IMG \"\"\">alert("XSS")\"><img /><br />\n<IMG SRC= onmouseover=\"alert('xxs')\"></p>"
|
|
5
5
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 23,
|
|
3
3
|
"input": "<IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"></img> <img src=x onerror=\"javascript:alert('XSS')\"> <IMG SRC=javascript:alert('XSS')> <IMG SRC=javascript:alert('XSS')> <IMG SRC=\"  javascript:alert('XSS');\">",
|
|
4
|
-
"result": "<p><IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"> <img src=\"https://images.ecency.com/p/35.png?format=match&mode=fit\" /> <IMG SRC=javascript:alert('XSS')> <img /> <img /></p>"
|
|
4
|
+
"result": "<p dir=\"auto\"><IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"> <img src=\"https://images.ecency.com/p/35.png?format=match&mode=fit\" /> <IMG SRC=javascript:alert('XSS')> <img /> <img /></p>"
|
|
5
5
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 25,
|
|
3
3
|
"input": "<IMG SRC=\"javascript:alert('XSS')\" </TITLE><SCRIPT>alert(\"XSS\");</SCRIPT>\n\n<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">\n\n<BODY BACKGROUND=\"javascript:alert('XSS')\">",
|
|
4
|
-
"result": "<p><IMG SRC=\"javascript:alert('XSS')\" alert("XSS");</p>\n<p></p>\n"
|
|
4
|
+
"result": "<p dir=\"auto\"><IMG SRC=\"javascript:alert('XSS')\" alert("XSS");</p>\n<p dir=\"auto\"></p>\n"
|
|
5
5
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 26,
|
|
3
3
|
"input": "<IMG DYNSRC=\"javascript:alert('XSS')\"> <IMG LOWSRC=\"javascript:alert('XSS')\"> <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE>",
|
|
4
|
-
"result": "<p><img /> <img /> </p>"
|
|
4
|
+
"result": "<p dir=\"auto\"><img /> <img /> </p>"
|
|
5
5
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 27,
|
|
3
3
|
"input": "<BR SIZE=\"&{alert('XSS')}\"> <LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\"> <STYLE>body{}</STYLE> <META HTTP-EQUIV=\"Link\" Content=\"<http://xss.rocks/xss.css>; REL=stylesheet\"> <IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME> foo <IFRAME SRC=# onmouseover=\"alert(document.cookie)\"></IFRAME> bar <FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET> baz ",
|
|
4
|
-
"result": "<p><br /> foo bar baz\n</p>"
|
|
4
|
+
"result": "<p dir=\"auto\"><br /> foo bar baz\n</p>"
|
|
5
5
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": 31,
|
|
3
3
|
"input": "<p><iframe src=\"https://player.vimeo.com/video/327023991?color=ff9c66\" width=\"640\" height=\"360\" frameborder=\"0\" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></p><p><iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/W-FCx_82csA\" frameborder=\"0\" allow=\"accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe></p><p><iframe src=\"https://player.twitch.tv/?channel=themexicanrunner\" frameborder=\"0\" allowfullscreen=\"true\" scrolling=\"no\" height=\"378\" width=\"620\"></iframe></p><p><iframe width=\"100%\" height=\"300\" scrolling=\"no\" frameborder=\"no\" allow=\"autoplay\" src=\"https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/560158971&color=%23ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true&visual=true\"></iframe></p>",
|
|
4
|
-
"result": "<p><iframe src=\"https://player.vimeo.com/video/327023991\" frameborder=\"0\" webkitallowfullscreen=\"webkitallowfullscreen\" mozallowfullscreen=\"mozallowfullscreen\" allowfullscreen=\"allowfullscreen\"></iframe></p><p><iframe src=\"https://www.youtube.com/embed/W-FCx_82csA\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"></iframe></p><p><iframe src=\"https://player.twitch.tv/?channel=themexicanrunner&parent=ecency.com&autoplay=false\" frameborder=\"0\" allowfullscreen=\"true\"></iframe></p><p><iframe frameborder=\"no\" src=\"https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/560158971&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&visual=true\"></iframe></p>"
|
|
4
|
+
"result": "<p dir=\"auto\"><iframe src=\"https://player.vimeo.com/video/327023991\" frameborder=\"0\" webkitallowfullscreen=\"webkitallowfullscreen\" mozallowfullscreen=\"mozallowfullscreen\" allowfullscreen=\"allowfullscreen\"></iframe></p><p dir=\"auto\"><iframe src=\"https://www.youtube.com/embed/W-FCx_82csA\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"></iframe></p><p dir=\"auto\"><iframe src=\"https://player.twitch.tv/?channel=themexicanrunner&parent=ecency.com&autoplay=false\" frameborder=\"0\" allowfullscreen=\"true\"></iframe></p><p dir=\"auto\"><iframe frameborder=\"no\" src=\"https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/560158971&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&visual=true\"></iframe></p>"
|
|
5
5
|
}
|