securitymb

3 ms·

1. 1.▲
   by securitymb 6y ago

   Even if comments were stripped (which sometimes happens), you could still put it in the URL or font family name: * { font-family: '</math>...'; }
2. 2.▲
   by securitymb 6y ago

   This would work and this something that Angular DomSanitizer does [1]. But I personally am not a big fan of this solution as it has large performance penalty if the sanitized string is huge. [1] https://github.com/angular&#x
3. 3.▲
   by securitymb 6y ago

   Hey, I'm the author of the write-up. Nice to see my research here! If you have any questions, please let me know.