Subject: html sanitizing tests
From: test &lt;[email-masked]&gt;
To: [email-masked]
Date: Sun, 13 Aug 2006 21:43:47 +0300 (EEST)

<html> <head> </head> <body> <h1>1 test</h1> <p>&lt;style&gt; block</p> <style>input { left:expression( alert('expression!') ) }</style> <style>div { background:url(alert('URL!') ) }</style> <h1>2 test</h1> <p>&lt;div&gt; block</p> <div style="{ left:expression( alert('expression!') ) }"> <div style="{ background:url( alert('URL!') ) }"> <h1>3 test</h1> <p>Inject comment text</p> <div style="{ left:exp/* */ression( alert('xss3') ) }"> <div style="{ background:u/* */rl( alert('xssurl3') ) }"> <h1>4 test</h1> <p>Using reverse solid to directe the codepoint</p> <div style="{ left:\0065\0078pression( alert('xss4') ) }"> <div style="{ background:\0075rl( alert('xssurl4') ) }"> <h1>5 test</h1> <p>Character entity references</p> <p>Character entity references is acceptable in "inline styles"</p> <div style="{ left:&#x0065;xpression( alert('xss') ) }"> <div style="{ left:&#101;xpression( alert('xss') ) }"> <div style="{ background:&#x0075;rl( alert('URL!') ) }"> <div style="{ background:&#117;rl( alert('URL!') ) }"> <div style="{ left:&#x0065xpression( alert('xss') ) }"> <div style="{ left:�.�.ｐ�.�.�.�.�.ｏ�.( alert('xss') ) }"> <div style="{ left:�.�.&#x2f;**/pression( alert('xss') ) }"> <div style="{ left:exp&#x0280;essio&#x0274;( alert('xss') ) }"> <div style="{ left:&#x5c;0065&#x5c;0078pression( alert('xss') ) }"> <div style="{ left:ex p ression( alert('xss') ) }"> <div style="{ background:�.�.�.( javascript:alert('xss') ) }"> <div style="{ background:&#x0075;/**/rl( javascript:alert('xss') ) }"> <div style="{ background:\0075\0072\006c( javascript:alert('xss') ) }"> <div style="{ background:u&#x0280;&#x029F;( javascript:alert('xss') ) }"> <div style="{ background:&#x5c;0075&#x5c;0280l( javascript:alert('xss') ) }"> <div style="{ background:u r l( javascript:alert('xss') ) }"> </body> </html>