xss-patterns.dsp

(?i)<script.*?>.*?</script>
(?i)<iframe.*?>.*?</iframe>
(?i)<object.*?>.*?</object>
(?i)<embed.*?>.*?</embed>
(?i)<applet.*?>.*?</applet>
(?i)<form.*?>.*?</form>
(?i)<link.*?href=["']javascript:.*?>
(?i)<meta.*?content=["'].*?url=.*?>
(?i)<body.*?onload=.*?>
(?i)<svg.*?>.*?</svg>
(?i)<img.*?src=["']javascript:.*?>
(?i)<base.*?href=["']javascript:.*?>
(?i)<audio.*?src=["']javascript:.*?>
(?i)<video.*?src=["']javascript:.*?>
(?i)on\w+\s*=["'].*?["']
(?i)style=["'].*?expression\(.*?\)
(?i)style=["'].*?url\(javascript:.*?\)
(?i)javascript:
(?i)vbscript:
(?i)data:text/html;base64
(?i)eval\(.*?\)
(?i)alert\(.*?\)
(?i)document\.cookie
(?i)document\.write
(?i)window\.location
(?i)setTimeout\(.*?\)
(?i)setInterval\(.*?\)
(?i)innerHTML
(?i)(?:&#x?[\da-f]+;?)+
(?i)<svg.*?onload=["'].*?["']
(?i)<svg.*?>.*?<script.*?>.*?</script>.*?</svg>
(?i)<audio.*?src=["'].*?["']
(?i)<video.*?src=["'].*?["']
(?i)<source.*?src=["'].*?["']
(?i)<track.*?src=["'].*?["']
(?i)<bgsound.*?src=["'].*?["']
(?i)document\.domain=.*
(?i)window\.open\(.*?\)
(?i)function\(.*?\)
(?i)\+\s*(window|document)
(?i)console\.log\(.*?\)
(?i)\.innerHTML
(?i)\.outerHTML