False Negatives in XSS Detection on Event Handler Attributes #70
Description
The libinjection.IsXSS() function fails to detect certain HTML5 event handler attributes as XSS vectors.
Environment:
- libinjection-go latest version
- Go 1.24.7
package main
import (
"fmt"
"github.com/corazawaf/libinjection-go"
)
func main() {
events := []string{
"onauxclick",
"onpagereveal",
"onpageswap",
"onscrollsnapchange",
"onscrollsnapchanging",
"onwebkitwillrevealbottom",
}
for i, event := range events {
payload := fmt.Sprintf("<tag %s=alert(1)>", event)
fmt.Printf("result %d (%s): %v\n", i, event, libinjection.IsXSS(payload))
}
}
Results:
result 0 (onauxclick): false
result 1 (onpagereveal): false
result 2 (onpageswap): false
result 3 (onscrollsnapchange): false
result 4 (onscrollsnapchanging): false
result 5 (onwebkitwillrevealbottom): false