Entities still parsed in uppercase

This vector transforms each entity into uppercase and checks if it is still rendered.

Created by: hackvertor

Created on: 7/2/2024, 5:15:34 PM

Updated on: 7/13/2024, 9:29:41 PM

Vector type: JS

Code used before fuzz:
const div = document.createElement('div');
Template used:
let entity = '$[data1]'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '$[data1]') {
   log(entity);
}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

let entity = '&'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&') {
   alert(entity);
}
let entity = '©'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '©') {
   alert(entity);
}
let entity = '&COPYSR;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&COPYSR;') {
   alert(entity);
}
let entity = 'ⅅ'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== 'ⅅ') {
   alert(entity);
}
let entity = 'Ŋ'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== 'Ŋ') {
   alert(entity);
}
let entity = 'Ð'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== 'Ð') {
   alert(entity);
}
let entity = '&GTCC;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTCC;') {
   alert(entity);
}
let entity = '&GTCIR;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTCIR;') {
   alert(entity);
}
let entity = '>'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '>') {
   alert(entity);
}
let entity = '&GTDOT;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTDOT;') {
   alert(entity);
}
let entity = '&GTLPAR;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTLPAR;') {
   alert(entity);
}
let entity = '&GTQUEST;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTQUEST;') {
   alert(entity);
}
let entity = '&GTRAPPROX;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTRAPPROX;') {
   alert(entity);
}
let entity = '&GTRARR;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTRARR;') {
   alert(entity);
}
let entity = '&GTRDOT;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTRDOT;') {
   alert(entity);
}
let entity = '&GTREQLESS;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTREQLESS;') {
   alert(entity);
}
let entity = '&GTREQQLESS;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTREQQLESS;') {
   alert(entity);
}
let entity = '&GTRLESS;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTRLESS;') {
   alert(entity);
}
let entity = '&GTRSIM;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&GTRSIM;') {
   alert(entity);
}
let entity = '&LTCC;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTCC;') {
   alert(entity);
}
let entity = '&LTCIR;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTCIR;') {
   alert(entity);
}
let entity = '<'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '<') {
   alert(entity);
}
let entity = '&LTDOT;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTDOT;') {
   alert(entity);
}
let entity = '&LTHREE;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTHREE;') {
   alert(entity);
}
let entity = '&LTIMES;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTIMES;') {
   alert(entity);
}
let entity = '&LTLARR;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTLARR;') {
   alert(entity);
}
let entity = '&LTQUEST;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTQUEST;') {
   alert(entity);
}
let entity = '&LTRI;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTRI;') {
   alert(entity);
}
let entity = '&LTRIE;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTRIE;') {
   alert(entity);
}
let entity = '&LTRIF;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTRIF;') {
   alert(entity);
}
let entity = '&LTRPAR;'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '&LTRPAR;') {
   alert(entity);
}
let entity = '"'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '"') {
   alert(entity);
}
let entity = '®'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '®') {
   alert(entity);
}
let entity = 'Þ'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== 'Þ') {
   alert(entity);
}
let entity = '™'.toUpperCase();
div.innerHTML= entity;
if(!div.innerText.includes(entity) && entity !== '™') {
   alert(entity);
}

Fuzz results

Safari logo
Safari 17.5 mobile iOS 17.5.1
Found 35 results
Data
&
Data
©
Data
&COPYSR;
Data
ⅅ
Data
Ŋ
Data
Ð
Data
>
Data
&GTCC;
Data
&GTCIR;
Data
&GTDOT;
Data
&GTLPAR;
Data
&GTQUEST;
Data
&GTRAPPROX;
Data
&GTRARR;
Data
&GTRDOT;
Data
&GTREQLESS;
Data
&GTREQQLESS;
Data
&GTRLESS;
Data
&GTRSIM;
Data
<
Data
&LTCC;
Data
&LTCIR;
Data
&LTDOT;
Data
&LTHREE;
Data
&LTIMES;
Data
&LTLARR;
Data
&LTQUEST;
Data
&LTRI;
Data
&LTRIE;
Data
&LTRIF;
Data
&LTRPAR;
Data
"
Data
®
Data
Þ
Data
™
Chrome logo
Chrome 126.0.0.0 desktop macOS 10.15.7
Found 35 results
Data
&
Data
©
Data
&COPYSR;
Data
ⅅ
Data
Ŋ
Data
Ð
Data
>
Data
&GTCC;
Data
&GTCIR;
Data
&GTDOT;
Data
&GTLPAR;
Data
&GTQUEST;
Data
&GTRAPPROX;
Data
&GTRARR;
Data
&GTRDOT;
Data
&GTREQLESS;
Data
&GTREQQLESS;
Data
&GTRLESS;
Data
&GTRSIM;
Data
<
Data
&LTCC;
Data
&LTCIR;
Data
&LTDOT;
Data
&LTHREE;
Data
&LTIMES;
Data
&LTLARR;
Data
&LTQUEST;
Data
&LTRI;
Data
&LTRIE;
Data
&LTRIF;
Data
&LTRPAR;
Data
"
Data
®
Data
Þ
Data
™
Safari logo
Safari 17.4 desktop macOS 10.15.7
Found 35 results
Data
&
Data
©
Data
&COPYSR;
Data
ⅅ
Data
Ŋ
Data
Ð
Data
>
Data
&GTCC;
Data
&GTCIR;
Data
&GTDOT;
Data
&GTLPAR;
Data
&GTQUEST;
Data
&GTRAPPROX;
Data
&GTRARR;
Data
&GTRDOT;
Data
&GTREQLESS;
Data
&GTREQQLESS;
Data
&GTRLESS;
Data
&GTRSIM;
Data
<
Data
&LTCC;
Data
&LTCIR;
Data
&LTDOT;
Data
&LTHREE;
Data
&LTIMES;
Data
&LTLARR;
Data
&LTQUEST;
Data
&LTRI;
Data
&LTRIE;
Data
&LTRIF;
Data
&LTRPAR;
Data
"
Data
®
Data
Þ
Data
™
Firefox logo
Firefox 127.0 desktop macOS 10.15
Found 35 results
Data
&
Data
©
Data
&COPYSR;
Data
ⅅ
Data
Ŋ
Data
Ð
Data
>
Data
&GTCC;
Data
&GTCIR;
Data
&GTDOT;
Data
&GTLPAR;
Data
&GTQUEST;
Data
&GTRAPPROX;
Data
&GTRARR;
Data
&GTRDOT;
Data
&GTREQLESS;
Data
&GTREQQLESS;
Data
&GTRLESS;
Data
&GTRSIM;
Data
<
Data
&LTCC;
Data
&LTCIR;
Data
&LTDOT;
Data
&LTHREE;
Data
&LTIMES;
Data
&LTLARR;
Data
&LTQUEST;
Data
&LTRI;
Data
&LTRIE;
Data
&LTRIF;
Data
&LTRPAR;
Data
"
Data
®
Data
Þ
Data
™