[<b onclick="console.log('Im in your mainframe :3')">I should not appear as bold</span>](/)
turns into
XSS attempt
Submitted 9 months ago by reimu to freeforum
Submitted 9 months ago by reimu to freeforum
[<b onclick="console.log('Im in your mainframe :3')">I should not appear as bold</span>](/)
turns into
reimu 9 months ago
[<span onmouseover="alert('Im in your mainframe :3')">I should not appear as a span</span>](/)turns into
I should not appear as a span
reimu 9 months ago
onclick and onmouseover again works in preview, but is sanitized away after submission.
But the child elements added arbitrarily still remain...