`. * A parser is not that strict: it ends a script at ``, or any `` needs no script tag and passed every rule. * So did an unquoted `href=javascript:alert(1)`, because the URL check required * the value to be quoted. * * These pages are published to the public web under our own domains, so what * gets through here is stored XSS on a page we serve. */ class EverySpellingOfAScriptTagTest extends TestCase { private function html(string $html): string { return app(SanitizeDocument::class)->sanitize($html, '', '')['html']; } /** @return list */ public static function scriptSpellings(): array { return [ 'the one that already worked' => ['

', 'alert(1)'], 'space before the close' => ['

', 'alert(2)'], 'slash before the close' => ['

', 'alert(3)'], 'newline before the close' => ["

', 'alert(5)'], 'uppercase' => ['

', 'alert(6)'], 'attributes on the open' => ['', 'alert(7)'], 'never closed at all' => ['

', 'evil.test'], ]; } #[DataProvider('scriptSpellings')] public function test_a_script_does_not_survive_any_spelling(string $input, string $payload): void { $this->assertStringNotContainsString( $payload, $this->html($input), 'this spelling of a script tag reached the published page', ); } /** And the content before an unterminated script is kept, not thrown away. */ public function test_the_page_before_an_unterminated_script_survives(): void { $result = $this->html('

Our offer

Real copy.

" title="x">'); $this->assertStringNotContainsString('alert(1)', $result); $this->assertStringNotContainsString('srcdoc', $result); $this->assertStringContainsString('title="x"', $result, 'the rest of the iframe was destroyed'); } /** An embedded video is still allowed, because landing pages use them. */ public function test_an_ordinary_iframe_embed_survives(): void { $result = $this->html(''); $this->assertStringContainsString('https://www.youtube.com/embed/abc', $result); } }