9 ms·
Second sample from the article does not work — non regular quotes, unmatched alert quote, fixed: <math><mtext><table><mglyph><style><math><table id="</tabl
by sergeykish 6y ago
Second sample from the article does not work — non regular quotes, unmatched alert quote, fixed:
<math><mtext><table><mglyph><style><math><table id="</table>"><img src onerror=alert(1)>
Works on Firefox, fail to reproduce bypass on Chrome http://sergeykish.com/dompurify-bypass http://sergeykish.com/dompurify-bypass
I've asked author, looks like Chrome parses src and srcdoc differently, works with innerHTML.
- triyambakam 6y agoThese are meant to be run through the DOMPurify library which serializes back to a different DOM tree than the input, so the input is not expected to work straight away
- sergeykish 6y agoYes, that's what it does. Check Firefox. First (unescaped) sample was my sanity check, yes, it alerts from <iframe>. It work in Chrome on div.innerHTML = sanitized but not on iframe.srcdoc = sanitized iframe.src = `data:text/html;charset=UTF-8,${sanitized}` I am rewriting document so it is possible to check different methods.