xBB-sxss

xBB XSS probe matrix v2 — focused follow-ups

21. xBBprobeXX21 — iframe WITH src (was allowed as empty tag in v1)

22. xBBprobeXX22 — iframe src data:text/html

23. xBBprobeXX23 — iframe src javascript:

24. xBBprobeXX24 — anchor with onclick only (no js scheme)

25. xBBprobeXX25 — SVG nested anchor javascript

26. xBBprobeXX26 — SVG xlink:href javascript

27. xBBprobeXX27 — MathML href

28. xBBprobeXX28 — MathML actiontype statusline

29. xBBprobeXX29 — Display KaTeX with \href

30. xBBprobeXX30 — KaTeX \htmlData

31. xBBprobeXX31 — KaTeX \includegraphics

32. xBBprobeXX32 — KaTeX \url

33. xBBprobeXX33 — meta http-equiv refresh to js

34. xBBprobeXX34 — object with data:text/html

35. xBBprobeXX35 — embed

36. xBBprobeXX36 — link rel=stylesheet

37. xBBprobeXX37 — style with @import

38. xBBprobeXX38 — noscript fallback

39. xBBprobeXX39 — base href + relative script

40. xBBprobeXX40 — data URI in markdown image (rendered as img src on some parsers)

xBBprobeXX41 - iframe srcdoc autoexec

xBBprobeXX42 - svg onload autoexec

xBBprobeXX43 - form action javascript

xBBprobeXX44 - iframe src obfuscated javascript scheme

xBBprobeXX45 - markdown link control-char javascript scheme

xBBprobeXX46 - iframe raw payload.html same-origin

xBBprobeXX47 - meta refresh javascript

xBBprobeXX48 - SVG foreignObject iframe srcdoc