Fuzzing for Max sanitized input (simplified)

33

Simplified test for Max (https://discord.com/channels/1110206757227216916/1168685918920638614/1358614602153201736)

Created on: Monday, April 7, 2025 at 11:26:32 AM

Updated on: Wednesday, May 28, 2025 at 5:06:20 PM

Category: HTML Parsing

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

<script>
window.onerror=x=>true;
</script>
<base href="https://example.com" />

<a id=x></a>

const mw = /^(?!javascript:)/i;
function nu(e) {
    return (e = String(e)).match(mw) ? e : "unsafe:" + e
}

const t = nu(`${String.fromCodePoint($[i])}javascript:alert(1)`);
x.href = t
x.protocol === 'javascript:' && log($[i])