| >>> Tags with attributes (block) | |
| <script src="foo.js"></script> | |
| <<< | |
| <script src="foo.js"></script> | |
| >>> Tags with spaces (block) | |
| <script > | |
| <<< | |
| <script > | |
| >>> Self-closing tags (block) | |
| <script/> | |
| <<< | |
| <script/> | |
| >>> Closing tags (block) | |
| </script> | |
| <<< | |
| </script> | |
| >>> HTML attributes with unquoted values (block) | |
| <script src=//evil/x.js> | |
| <<< | |
| <script src=//evil/x.js> | |
| >>> Other disallowed tags like iframe (block) | |
| <iframe srcdoc="evil"> | |
| <<< | |
| <iframe srcdoc="evil"> | |
| >>> Tags with attributes (inline) | |
| foo <script src="foo.js"></script> | |
| <<< | |
| <p>foo <script src="foo.js"></script></p> | |
| >>> Tags with spaces (inline) | |
| foo <script > | |
| <<< | |
| <p>foo <script ></p> | |
| >>> Self-closing tags (inline) | |
| foo <script/> | |
| <<< | |
| <p>foo <script/></p> | |
| >>> Closing tags (inline) | |
| foo </script> | |
| <<< | |
| <p>foo </script></p> | |
| >>> HTML attributes with unquoted values (inline) | |
| foo <script src=//evil/x.js> | |
| <<< | |
| <p>foo <script src=//evil/x.js></p> | |
| >>> Other disallowed tags like iframe (inline) | |
| foo <iframe srcdoc="evil"> | |
| <<< | |
| <p>foo <iframe srcdoc="evil"></p> |