(id, content)
| 6788 | 'parse-time template expansion neutralizes weaponized payloads', |
| 6789 | (assert) => { |
| 6790 | const link = (id, content) => |
| 6791 | `<div><?marker name="${id}"></div>` + |
| 6792 | `<template for="${id}">${content}</template>`; |
| 6793 | const cases = { |
| 6794 | 'img onerror': link('a', '<img src=x onerror=alert(1)>'), |
| 6795 | script: link('b', '<script>alert(1)<\/script>'), |