Create New Item
Item Type
File
Folder
Item Name
Search file in folder and subfolders...
Are you sure want to rename?
Vlkn
/
plugins-dist
/
mediabox
/
img
:
SafeHtmlTest.php
Advanced Search
Upload
New Item
Settings
Back
Back Up
Advanced Editor
Save
<?php namespace Spip\Core\Tests; use PHPUnit\Framework\TestCase; class SafeHtmlTest extends TestCase { protected static $safehtml; public static function setUpBeforeClass(): void { find_in_path('inc/texte_mini.php', '', true); // chercher la fonction si elle n'existe pas if (!function_exists(static::$safehtml = 'safehtml')) { find_in_path('inc/filtres.php', '', true); static::$safehtml = chercher_filtre(static::$safehtml); } } /** * @dataProvider providerXSS */ public function testXSS($expected, $source) { $safehtml = static::$safehtml; $actual = $safehtml($source); if (is_string($expected) && str_contains($expected, '"')) { $expected = [$expected, str_replace('"', '"', $expected)]; } if (is_array($expected)) { $this->assertContains($actual, $expected); } else { $this->assertEquals($expected, $actual); } } public static function providerXSS() { $essais = [ 0 => [ 0 => '', 1 => '' ], 1 => [ 0 => '0', 1 => '0' ], 2 => [ 0 => [ 'Un texte avec des <a href="http://spip.net">liens</a> [Article 1->art1] [spip->https://www.spip.net] https://www.spip.net', 'Un texte avec des <a href="http://spip.net">liens</a> [Article 1->art1] [spip->https://www.spip.net] https://www.spip.net', ], 1 => 'Un texte avec des <a href="http://spip.net">liens</a> [Article 1->art1] [spip->https://www.spip.net] https://www.spip.net' ], 3 => [ 0 => 'Un texte avec des entités &<>"', 1 => 'Un texte avec des entités &<>"' ], 4 => [ 0 => 'Un texte avec des entit&eacute;s echap&eacute; &amp;&lt;&gt;&quot;', 1 => 'Un texte avec des entit&eacute;s echap&eacute; &amp;&lt;&gt;&quot;' ], 5 => [ 0 => 'Un texte avec des entités numériques &<>"', 1 => 'Un texte avec des entités numériques &<>"' ], 6 => [ 0 => 'Un texte avec des entit&#233;s num&#233;riques echap&#233;es &#38;&#60;&#62;&quot;', 1 => 'Un texte avec des entit&#233;s num&#233;riques echap&#233;es &#38;&#60;&#62;&quot;' ], 7 => [ 0 => [ 'Un texte sans entites &<>"\'', 'Un texte sans entites &<>"\'', ], 1 => 'Un texte sans entites &<>"\'' ], 8 => [ 0 => '{{{Des raccourcis}}} {italique} {{gras}} <code>du code</code>', 1 => '{{{Des raccourcis}}} {italique} {{gras}} <code>du code</code>' ], 9 => [ 0 => [ 'Un modele https://www.spip.net]>', 'Un modele https://www.spip.net]>', ], 1 => 'Un modele <modeleinexistant|lien=[->https://www.spip.net]>' ], 10 => [ 0 => 'Un texte avec des retour a la ligne et meme des paragraphes', 1 => 'Un texte avec des retour a la ligne et meme des paragraphes' ], 11 => [ 0 => [ '\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//-->">\'><code class="echappe-js"><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT></code>=&{}', '\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//-->">\'><code class="echappe-js"><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT></code>=&{}', ], 1 => '\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}' ], 12 => [ 0 => ['\'\';!--"<xss>=&{()}</xss>', '\'\';!--"=&{()}'], 1 => '\'\';!--"<XSS>=&{()}' ], 13 => [ 0 => '<code class="echappe-js"><SCRIPT>alert(\'XSS\')</SCRIPT></code>', 1 => '<SCRIPT>alert(\'XSS\')</SCRIPT>' ], 14 => [ 0 => '<code class="echappe-js"><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT></code>', 1 => '<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>' ], 15 => [ 0 => '<code class="echappe-js"><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT></code>', 1 => '<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>' ], 16 => [ 0 => [ '<base HREF="javascript:alert(\'XSS\');//">', '<base HREF="javascript:alert(\'XSS\');//">', ], 1 => '<BASE HREF="javascript:alert(\'XSS\');//">' ], 17 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><BGSOUND SRC="javascript:alert(\'XSS\');"></code>', 1 => '<BGSOUND SRC="javascript:alert(\'XSS\');">' ], 18 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><BODY BACKGROUND="javascript:alert(\'XSS\');"></code>', 1 => '<BODY BACKGROUND="javascript:alert(\'XSS\');">' ], 19 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><BODY ONLOAD=alert(\'XSS\')></code>', 1 => '<BODY ONLOAD=alert(\'XSS\')>' ], 20 => [ 0 => '<div></div>', 1 => '<DIV STYLE="background-image: url(javascript:alert(\'XSS\'))">' ], 21 => [ 0 => '<div></div>', 1 => '<DIV STYLE="background-image: url(javascript:alert(\'XSS\'))">' ], 22 => [ 0 => '<div></div>', 1 => '<DIV STYLE="width: expression(alert(\'XSS\'));">' ], 23 => [ 0 => '', 1 => '<FRAMESET><FRAME SRC="javascript:alert(\'XSS\');"></FRAMESET>' ], 24 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IFRAME SRC="javascript:alert(\'XSS\');"></code><code></IFRAME></code>', 1 => '<IFRAME SRC="javascript:alert(\'XSS\');"></IFRAME>' ], 25 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><INPUT TYPE="IMAGE" SRC="javascript:alert(\'XSS\');"></code>', 1 => '<INPUT TYPE="IMAGE" SRC="javascript:alert(\'XSS\');">' ], 26 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC="javascript:alert(\'XSS\');"></code>', 1 => '<IMG SRC="javascript:alert(\'XSS\');">' ], 27 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=javascript:alert(\'XSS\')></code>', 1 => '<IMG SRC=javascript:alert(\'XSS\')>' ], 28 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG DYNSRC="javascript:alert(\'XSS\');"></code>', 1 => '<IMG DYNSRC="javascript:alert(\'XSS\');">' ], 29 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG LOWSRC="javascript:alert(\'XSS\');"></code>', 1 => '<IMG LOWSRC="javascript:alert(\'XSS\');">' ], 30 => [ 0 => [ '<img src="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode" />', '<img src="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode" alt="somecommand.php?somevariables=maliciouscode" />', '<img src="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode" alt="somecommand.php?somevariables=maliciouscode">', ], 1 => '<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">' ], 31 => [ 0 => [ 'exp/*<xss style="noxss:noxss("*/pression(alert("XSS"))"></xss>', 'exp/*', ], 1 => 'exp/*<XSS STYLE=\'no\\xss:noxss("*//*"); xss:ex/*XSS*//*/*/pression(alert("XSS"))\'>' ], 32 => [ 0 => '<ul><li>XSS</li></ul>', 1 => '<STYLE>li {list-style-image: url("javascript:alert(\'XSS\')");}</STYLE><UL><LI>XSS' ], 33 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=\'vbscript:msgbox("XSS")\'></code>', 1 => '<IMG SRC=\'vbscript:msgbox("XSS")\'>' ], 34 => [ 0 => '', 1 => '<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>' ], 35 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC="livescript:[code]"></code>', 1 => '<IMG SRC="livescript:[code]">' ], 36 => [ 0 => '�script�alert(�XSS�)�/script�', 1 => '�script�alert(�XSS�)�/script�' ], 37 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(\'XSS\');"></code>', 1 => '<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(\'XSS\');">' ], 38 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"></code>', 1 => '<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">' ], 39 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(\'XSS\');"></code>', 1 => '<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(\'XSS\');">' ], 40 => [ 0 => ['<img />', ''], 1 => '<IMG SRC="mocha:[code]">' ], 41 => [ 0 => '', 1 => '<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>' ], 42 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389></code><code><param name=url value=javascript:alert(\'XSS\')></code><code></OBJECT></code>', 1 => '<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert(\'XSS\')></OBJECT>' ], 43 => [ 0 => '', 1 => '<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>' ], 44 => [ 0 => '', 1 => '<STYLE TYPE="text/javascript">alert(\'XSS\');</STYLE>' ], 45 => [ 0 => ['<img />', ''], 1 => '<IMG STYLE="xss:expr/*XSS*/ession(alert(\'XSS\'))">' ], 46 => [ 0 => ['<xss></xss>', ''], 1 => '<XSS STYLE="xss:expression(alert(\'XSS\'))">' ], 47 => [ 0 => '<a class="XSS"></a>', 1 => '<STYLE>.XSS{background-image:url("javascript:alert(\'XSS\')");}</STYLE><A CLASS=XSS></A>' ], 48 => [ 0 => '', 1 => '<STYLE type="text/css">BODY{background:url("javascript:alert(\'XSS\')")}</STYLE>' ], 49 => [ 0 => '', 1 => '<LINK REL="stylesheet" HREF="javascript:alert(\'XSS\');">' ], 50 => [ 0 => '', 1 => '<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">' ], 51 => [ 0 => '', 1 => '<STYLE>@import\'http://ha.ckers.org/xss.css\';</STYLE>' ], 52 => [ 0 => '', 1 => '<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">' ], 53 => [ 0 => '', 1 => '<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>' ], 54 => [ 0 => ['<table></table>', ''], 1 => '<TABLE BACKGROUND="javascript:alert(\'XSS\')"></TABLE>' ], 55 => [ 0 => [ '<table><td></td></table>', '<table></table>', '', ], 1 => '<TABLE><TD BACKGROUND="javascript:alert(\'XSS\')"></TD></TABLE>' ], 56 => [ 0 => [ ' <?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"> XSS ', ' <?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"> XSS', ], 1 => '<HTML xmlns:xss> <?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"> <xss:xss>XSS</xss:xss> </HTML>' ], 57 => [ 0 => [ '<span></span>', '<IMG SRC="javascript:alert(\'XSS\');"> <span></span>', ], 1 => '<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert(\'XSS\');">]]> </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>' ], 58 => [ 0 => ['<i><b><img src="javas" alt="javas<!-- -->cript:alert(\'XSS\')"></b></i> <span></span>', ], 1 => '<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert(\'XSS\')"></B></I></XML> <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>' ], 59 => [ 0 => [ ' <span></span>', '<span></span>', ], 1 => '<XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML> <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>' ], 60 => [ 0 => [ ' <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> <?import namespace="t" implementation="#default#time2"> <SCRIPT DEFER>alert(\'XSS\')</SCRIPT>"> ', ' <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> <?import namespace="t" implementation="#default#time2"> <SCRIPT DEFER>alert(\'XSS\')</SCRIPT>"> ', ], 1 => '<HTML><BODY> <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> <?import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert(\'XSS\')</SCRIPT>"> </BODY></HTML>' ], 61 => [ 0 => '', 1 => '<!--[if gte IE 4]> <SCRIPT>alert(\'XSS\');</SCRIPT> <![endif]-->' ], 62 => [ 0 => [ '<SCRIPT>alert(\'XSS\')</SCRIPT>">', '<SCRIPT>alert(\'XSS\')</SCRIPT>">', ], 1 => '<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(\'XSS\')</SCRIPT>">' ], 63 => [ 0 => ['<xss></xss>', ''], 1 => '<XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);">' ], 64 => [ 0 => '<code class="echappe-js"><SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT></code>', 1 => '<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>' ], 65 => [ 0 => '', 1 => '<!--#exec cmd="/bin/echo \'<SCRIPT SRC\'"--><!--#exec cmd="/bin/echo \'=http://ha.ckers.org/xss.js></SCRIPT>\'"-->' ], 66 => [ 0 => [ '<? echo(\'alert("XSS")\'); ?>', '<? echo(\'alert("XSS")\'); ?>', ], 1 => '<? echo(\'<SCR)\'; echo(\'IPT>alert("XSS")</SCRIPT>\'); ?>' ], 67 => [ 0 => ['<br size="&{alert(\'XSS\')}" />', '<br />', '<br>'], 1 => '<BR SIZE="&{alert(\'XSS\')}">' ], 68 => [ 0 => [ '< %3C < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < \\x3c \\x3C \\u003c \\u003C', '< %3C &lt < &LT &LT; < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < \\x3c \\x3C \\u003c \\u003C', ], 1 => '< %3C < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < \\x3c \\x3C \\u003c \\u003C' ], 69 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=JaVaScRiPt:alert(\'XSS\')></code>', 1 => '<IMG SRC=JaVaScRiPt:alert(\'XSS\')>' ], 70 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=javascript:alert("XSS")></code>', 1 => '<IMG SRC=javascript:alert("XSS")>' ], 71 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`></code>', 1 => '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>' ], 72 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=javascript:alert(String.fromCharCode(88,83,83))></code>', 1 => '<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>' ], 73 => [ 0 => [ '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=javascript:alert(\'XSS\')></code>', ], 1 => '<IMG SRC=javascript:alert('XSS')>' ], 74 => [ 0 => [ '<img />', '', ], 1 => '<IMG SRC=javascript:alert('XSS')>' ], 75 => [ 0 => [ '<div style="background-image:00750072006C0028\'006a006100760061007300630072006900700074003a0061006c0065007200740028.10270058.1053005300270029\'0029"></div>', '<div></div>', ], 1 => '<DIV STYLE="background-image:\\0075\\0072\\006C\\0028\'\\006a\\0061\\0076\\0061\\0073\\0063\\0072\\0069\\0070\\0074\\003a\\0061\\006c\\0065\\0072\\0074\\0028.1027\\0058.1053\\0053\\0027\\0029\'\\0029">' ], 76 => [ 0 => [ '<img />', '', ], 1 => '<IMG SRC=javascript:alert('XSS')>' ], 77 => [ 0 => [ ' +ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-/SCRIPT+AD4-', '+ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-/SCRIPT+AD4-', ], 1 => '<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-/SCRIPT+AD4-' ], 78 => [ 0 => '\\";alert(\'XSS\');//', 1 => '\\";alert(\'XSS\');//' ], 79 => [ 0 => '<code class="echappe-js"><SCRIPT>alert("XSS");</SCRIPT></code>', 1 => '</TITLE><SCRIPT>alert("XSS");</SCRIPT>' ], 80 => [ 0 => '', 1 => '<STYLE>@im\\port\'\\ja\\vasc\\ript:alert("XSS")\';</STYLE>' ], 81 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC="jav ascript:alert(\'XSS\');"></code>', 1 => '<IMG SRC="jav ascript:alert(\'XSS\');">' ], 82 => [ // tabulation 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC="jav ascript:alert(\'XSS\');"></code>', 1 => '<IMG SRC="jav	ascript:alert(\'XSS\');">' ], 83 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC="jav ascript:alert(\'XSS\');"></code>', 1 => '<IMG SRC="jav
ascript:alert(\'XSS\');">' ], 84 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC="jav ascript:alert(\'XSS\');"></code>', 1 => '<IMG SRC="jav
ascript:alert(\'XSS\');">' ], 85 => [ 0 => [ '<img /> ', '<img src="j%20a%20v%20a%20s%20c%20r%20i%20p%20t%20%3A%20a%20l%20e%20r%20t%20(%20\'%20X%20S%20S%20\'%20)" alt="j a v a s c r i p t : a l e r t ( \' X S S \' )"> ', ], 1 => '<IMG SRC = " j a v a s c r i p t : a l e r t ( \' X S S \' ) " > ' ], 86 => [ 0 => [ '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=javascript:alert("XSS")></code>', ], 1 => '<IMG SRC=java' . "\0" . 'script:alert("XSS")>' ], 87 => [ 0 => ['&alert("XSS")', '&'], 1 => '&<SCR' . "\0" . 'IPT>alert("XSS")</SCR' . "\0" . 'IPT>' ], 88 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><IMG SRC=" &#14; javascript:alert(\'XSS\');"></code>', 1 => '<IMG SRC="  javascript:alert(\'XSS\');">' ], 89 => [ 0 => '<code class="echappe-js"><SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>', 1 => '<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>' ], 90 => [ 0 => ['|\\]^`=alert("XSS")>', ''], 1 => '<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert("XSS")>' ], 91 => [ 0 => '<code class="echappe-js"><SCRIPT SRC=http://ha.ckers.org/xss.js</code>', 1 => '<SCRIPT SRC=http://ha.ckers.org/xss.js' ], 92 => [ 0 => '<code class="echappe-js"><SCRIPT SRC=//ha.ckers.org/.j></code>', 1 => '<SCRIPT SRC=//ha.ckers.org/.j>' ], 93 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <IMG SRC="javascript:alert(\'XSS\')"', 1 => '<IMG SRC="javascript:alert(\'XSS\')"' ], 94 => [ 0 => '', 1 => '<IFRAME SRC=http://ha.ckers.org/scriptlet.html <' ], 95 => [ 0 => '<<code class="echappe-js"><SCRIPT>alert("XSS");//<</SCRIPT></code>', 1 => '<<SCRIPT>alert("XSS");//<</SCRIPT>' ], 96 => [ 0 => [ '<img /><code class="echappe-js"><SCRIPT>alert("XSS")</SCRIPT></code>">', '<code class="echappe-js"><SCRIPT>alert("XSS")</SCRIPT></code>">', ], 1 => '<IMG """><SCRIPT>alert("XSS")</SCRIPT>">' ], 97 => [ 0 => [ '<code class="echappe-js"><SCRIPT>a=/XSS/<br /> alert(a.source)</SCRIPT></code>', '<code class="echappe-js"><SCRIPT>a=/XSS/<br> alert(a.source)</SCRIPT></code>', ], 1 => '<SCRIPT>a=/XSS/ alert(a.source)</SCRIPT>' ], 98 => [ 0 => '<code class="echappe-js"><SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>', 1 => '<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>' ], 99 => [ 0 => '<code class="echappe-js"><SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>', 1 => '<SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT>' ], 100 => [ 0 => '<code class="echappe-js"><SCRIPT a="blah" \'\' SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>', 1 => '<SCRIPT a="blah" \'\' SRC="http://ha.ckers.org/xss.js"></SCRIPT>' ], 101 => [ 0 => '<code class="echappe-js"><SCRIPT "a=\'>\'" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>', 1 => '<SCRIPT "a=\'>\'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>' ], 102 => [ 0 => '<code class="echappe-js"><SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>', 1 => '<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>' ], 103 => [ 0 => [ '<code class="echappe-js"><SCRIPT>document.write("<SCRI");</SCRIPT></code>PT SRC="http://ha.ckers.org/xss.js">', '<code class="echappe-js"><SCRIPT>document.write("<SCRI");</SCRIPT></code>PT SRC="http://ha.ckers.org/xss.js">', ], 1 => '<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>' ], 104 => [ 0 => '<code class="echappe-js"><SCRIPT a=">\'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>', 1 => '<SCRIPT a=">\'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>' ], 105 => [ 0 => '<a href="http://66.102.7.147/">XSS</a>', 1 => '<A HREF="http://66.102.7.147/">XSS</A>' ], 106 => [ 0 => [ '<a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</a>', '<a href="http://www.google.com">XSS</a>', ], 1 => '<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>' ], 107 => [ 0 => '<a href="http://1113982867/">XSS</a>', 1 => '<A HREF="http://1113982867/">XSS</A>' ], 108 => [ 0 => '<a href="http://0x42.0x0000066.0x7.0x93/">XSS</a>', 1 => '<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>' ], 109 => [ 0 => '<a href="http://0102.0146.0007.00000223/">XSS</a>', 1 => '<A HREF="http://0102.0146.0007.00000223/">XSS</A>' ], 110 => [ 0 => [ '<a>XSS</a>', '<a href="h%20tt%20p%3A//6%206.000146.0x7.147/">XSS</a>', ], 1 => '<A HREF="h tt p://6	6.000146.0x7.147/">XSS</A>' ], 111 => [ 0 => '<a href="//www.google.com/">XSS</a>', 1 => '<A HREF="//www.google.com/">XSS</A>' ], 112 => [ 0 => '<a href="//google">XSS</a>', 1 => '<A HREF="//google">XSS</A>' ], 113 => [ 0 => [ '<a href="http://ha.ckers.org@google">XSS</a>', '<a href="http://google">XSS</a>', ], 1 => '<A HREF="http://ha.ckers.org@google">XSS</A>' ], 114 => [ 0 => [ '<a href="http://google:ha.ckers.org">XSS</a>', '<a href="http://google">XSS</a>', ], 1 => '<A HREF="http://google:ha.ckers.org">XSS</A>' ], 115 => [ 0 => '<a href="http://google.com/">XSS</a>', 1 => '<A HREF="http://google.com/">XSS</A>' ], 116 => [ 0 => '<a href="http://www.google.com./">XSS</a>', 1 => '<A HREF="http://www.google.com./">XSS</A>' ], 117 => [ 0 => '<mark class="danger-js" title="Texte échappé">⚠️</mark> <code><A HREF="javascript:document.location=\'http://www.google.com/\'"></code>XSS', 1 => '<A HREF="javascript:document.location=\'http://www.google.com/\'">XSS</A>' ], 118 => [ 0 => [ '<a href="http://www.gohttp://www.google.com/ogle.com/">XSS</a>', // safehtml '<a href="http://www.gohttp//www.google.com/ogle.com/">XSS</a>', // htmlpurifier ], 1 => '<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>' ], 119 => [ 0 => '<span class="montant" data-montant-nombre="100" data-montant-devise="EUR"></span>', 1 => '<span class="montant" data-montant-nombre="100" data-montant-devise="EUR">' ], 120 => [ 0 => '<span class="montant" itemscope itemtype="https://schema.org/PriceSpecification" data-montant-nombre="30" data-montant-devise="EUR"><span class="montant__inner" itemprop="price" content="30">30,00 <span class="montant__devise" itemprop="priceCurrency" content="EUR">EUR</span></span></span>', 1 => '<span class="montant" itemscope itemtype="https://schema.org/PriceSpecification" data-montant-nombre="30" data-montant-devise="EUR"><span class="montant__inner" itemprop="price" content="30">30,00 <span class="montant__devise" itemprop="priceCurrency" content="EUR">EUR</span></span></span>' ], 121 => [ 0 => '<span class="montant" data-montant-nombre="30" data-montant-devise="EUR">30,00 <span class="montant__devise">EUR</span><meta itemprop="price" content="30" /><meta itemprop="priceCurrency" content="EUR"></span>', 1 => '<span class="montant" data-montant-nombre="30" data-montant-devise="EUR">30,00 <span class="montant__devise">EUR</span><meta itemprop="price" content="30" /><meta itemprop="priceCurrency" content="EUR"></span>' ], 122 => [ 0 => '<span class="montant" data-montant-nombre="30" data-montant-devise="EUR">30,00 <span class="montant__devise">EUR</span><meta itemprop="price" content="30" /><meta itemprop="priceCurrency" content="EUR"></span>', 1 => '<span class="montant" data-montant-nombre="30" data-montant-devise="EUR">30,00 <span class="montant__devise">EUR</span><meta itemprop="price" content="30" /><meta itemprop="priceCurrency" content="EUR"></span>' ], 123 => [ 0 => '<span class="montant" data-montant-nombre="30" data-montant-devise="EUR">30,00 <span class="montant__devise">EUR</span><meta itemprop="price" content="30" /><meta itemprop="priceCurrency" content="EUR" /></span>', 1 => '<span class="montant" data-montant-nombre="30" data-montant-devise="EUR">30,00 <span class="montant__devise">EUR</span><meta itemprop="price" content="30" /><meta http-equiv="Link" itemprop="priceCurrency" content="EUR"></span>' ] ]; return $essais; } }