Function _executableFindings

test/test-suite.js:6757–6780

(root)

    /* Collect anything executable reachable from a serialized string, walking
       into <template>.content and any activated shadowRoot. */
    const _executableFindings = function (root) {
      const findings = [];
      const visit = (node) => {
        if (!node) return;
        if (node.nodeType === 1) {
          const tag = node.tagName ? node.tagName.toLowerCase() : '';
          for (const name of node.getAttributeNames()) {
            if (/^on/i.test(name)) findings.push(`${tag}@${name}`);
            if (
              (name === 'href' || name === 'src' || name === 'xlink:href') &&
              /^\s*(?:java|vb)script:/i.test(node.getAttribute(name) || '')
            ) {
              findings.push(`${tag}@${name}=js`);
            }
          }
          if (tag === 'script') findings.push('script');
          if (node.shadowRoot) visit(node.shadowRoot);
          if (tag === 'template' && node.content) visit(node.content);
        }
        for (const child of node.childNodes) visit(child);
      };
      visit(root);
      return findings;
    };
    const _findingsFromHTML = function (html) {
      const holder = document.createElement('div');
      holder.innerHTML = html;