[<b onclick="console.log('Im in your mainframe :3')">I should not appear as bold</span>](/)
turns into
XSS attempt
Submitted 1 year ago by reimu to freeforum
Submitted 1 year ago by reimu to freeforum
[<b onclick="console.log('Im in your mainframe :3')">I should not appear as bold</span>](/)
turns into
reimu 1 year ago
[<span onmouseover="alert('Im in your mainframe :3')">I should not appear as a span</span>](/)turns into
I should not appear as a span
reimu 1 year ago
onclick and onmouseover again works in preview, but is sanitized away after submission.
But the child elements added arbitrarily still remain...