XSS on Google Search - Sanitizing HTML in The Client?

[@alexc8992]

I blame Tom Scott for this since he said that Google was fine in a video about XSS. He probably inspired people to try it.

[@LiveOverflow]

Google is constantly changing, so errors can always pop-up. But that's also why Google invests a lot of money into bug-bounty, so researchers like Masato get paid for it ;)

[@Thect]

blame Tom Scott

[@nilsirl]

Can you give us a little bit of context? What did Tom Scott do?

[@whydoineedausername1386]

He made a video explaining XSS (using an XSS bug in a twitter client as an example because it was recent at the time) and in it claimed that google is trustworthy as a company that is safe and wouldn't allow XSS. That inspired people to try and get XSS working on google

[@fluent_styles6720]

It was the self-retweeting tweet video, wasn't it?

[@DustDaAnt]

Google: HEY HEY! STOP! Me: What? Google: 1

[@NicholasFagan]

Amazing vulnerability! Loosely parsing html always seems silly to me. If browsers started being strict about displaying html, people would start being strict when writing it.

[@mirradric]

Sadly xhtml died a sad death

[@WoolieOG]

or just give option to websites to opt-out from corrections, and make browser render html 1:1.

[@omri9325]

That's kind of a feedback loop, browser vendors do not want their browsers to stop working on a lot of site unexpectedly.

[@rogercruz1547]

@@omri9325 Maybe we can write some extensions/plugins for major browsers that parse everything as xhtml...

[@karlkastor]

Unbelievable that Google had an XSS like that. Really interesting attack and great explanation, was really easy to understand. I hope Masato got a big bug bounty.

[@abc321meins]

@M. de k. Don't you think thats way to little? He could have overtaken the internet and make Billions with this XSS in less than a day...

[@abc321meins]

@M. de k. Hmm, yeah you're right I guess.

[@abc321meins]

@M. de k. But to be honest, for 3000$ I'd have kept it a secret and used it to rickroll as manny people as possible. The faces of my coworkers would have been priceless.

[@miguelricardosobong4927]

@@abc321meins then you'd be persecuted and no money...

[@trieulieuf9]

M. de k. Hi, i am curious, who does he get the bounty? Google see his tweet and verify it is a bug then give him money? Or he needs to report it to google?

[@domaincontroller]

00:52 basics XSS 05:10 mutation XSS 05:35 Client-side sanitization, DOMPurifiy 07:47 masato, noscript element 10:38 DOM XSS

[@nobody7557]

I got goosebumps when the alert(1) opened.

[@termviewerthelost75]

Cedric Brandt

[@YitocukKilic]

1

[@Pinkkprincess1]

Alert: (1) [OK]

[@Retrenorium]

@@pseudoforceyt AaaaaAAAAAAAA

[@muhdsafie805]

@@termviewerthelost75 nmn n m n m n m

[@_DeProgrammer]

I think this is honestly, one of the best channels on KZbin. The time you put in to explain and share what you learn with us is GOLDEN! thanks dude. I'll support.

[@mtssvnsn]

So, in conclusion: 1.) Sanitizing should be done on the client, because its hard to do on the the server. 2.) Woops!

[@renakunisaki]

3) The noscript tag is parsed differently depending on context.

[@JochemKuijpers]

4) replacing all with their appropriate html entities before DOM insertion would have fixed this.

[@otesunki]

5) ok lets filter & and " but not < or > .

[@unarei]

@@JochemKuijpers or adding textnodes instead of using innerhtml in the first place. there was probably some reason they needed a limited set of tags though.

[@NetheriteMiner]

wouldn't filtering < do everything? I'm new at XSS please help

[@mobile_ingou]

With the second example with the invalid code, the browser was correct. tags are CDATA, meaning that the contents will never be interpreted as HTML. It also means they cannot be self closing. It is not because of parsers. With both examples, the browser is not being "weird". It is following the W3C spec, which states that scripts are CDATA, and that browsers must auto-close tags. BTW, great video!!!

[@oldbootz]

This is brilliant, and the vid goes so deep and thorough on the topic. You really are the best security channel on YT.

[@dominiksulzer1338]

Thankfully there is a javascript framework for everything :D

[@devttyUSB0]

I always use regular expressions to parse HTML! :P

[@twistedsim]

😂🤣

[@karlkastor]

I actually do that a lot for webscrapers. It is faster than an actual XML/HTML parser and it doesn't make much of a difference when it doesn't have to be hundred percent accurate. Although, if one of my download tool gets outside input, I should abstain from these methods, because someone could inject something. Although the worst case scenario in that case is that wrong data gets downloaded.

[@tvili999]

I think they are using it too. Most language parsers somehow use regex. 😁 BTW I think regex is one of the perfect examples on how amazing things were created in the old days, when they had no clue how important it will be, and they cared to do these algorithms the best possible way.

[@alphatier4919]

"Regex" and "parse" in 1 sentence... My hearth stopped beating.....

[@WolfrostWasTaken]

Evil RegEx input is coming at you muahahahaahah

[@문동선-j7d]

When you literally hacked Google and everyone else thinks it's just an April fool's joke. Achievement unlocked: Hacking Google.

[@alandosman5002]

문동선 you can’t hack websites with XSS

[@문동선-j7d]

@@alandosman5002 yet you know you're hacking it when you find an exploit like that

[@cyborggoat2467]

@@문동선-j7d its an exploit, more of a bug or easter egg of sorts, not hacking

[@MrGrazyD96]

@@cyborggoat2467 what do you think is hacking then?

[@cyborggoat2467]

@@MrGrazyD96 literally getting into their servers, being able to see what they see, break it if you so chose

[@developermaroc9988]

What I like the most is that all videos are free to download offline on KZbin, thank you

[@DarkOverFlowOverflow]

Keep making websecurity videos keep up the good work

[@poincareless105]

Every time i watch your videos i keep another mind as a spare, to replace the blown mind. thank you

[@Zooiest]

He’s not the copypaste machine, he’s the one who makes the exploits Reference to your older video 🙃

[@LiveOverflow]

Masato is a browser bug machine!!!

[@Zooiest]

LiveOverflow thanks for the heart and reply :3

[@Dakta96]

Copypasting is also boring just create something to do it for you if you really want to

[@madghostek3026]

Now this is scary how many sites use the template parser, which appears to be vulnerable

[@10F2C]

attacker's dream

[@Nick_Tag]

This video blows my mind in how it archives what happened - as it was happening!

[@blackAngel88it]

2:53 neither html, head or body are required elements for valid html. in a minimalistic webpage, only the title element is required. Also, we're kinda talking here about code embedded into an already existing site, so the validity only comes down to "broken" tags and non escaped characters () inside an attribute.

[@PurplProto]

LiveOverflow: "Google search is arguably the front page of the internet" Reddit: *sad noises*

[@kartoffelwaffel]

holy f that debugger tip at 10:26 blew my mind! thanks!

[@thatLukeKneller]

I've worked in javascript for too many years and not known that... god damn

[@bensaputra1567]

Same here :D lol

[@threeMetreJim]

New Facebook games may be an opportunity to hunt down bugs similar to this, they are quite often hurried through, especially the ones by smaller teams of programmers. I got one before, managed to insert html to play a KZbin video offscreen (for the sound effects). It actually got a laugh out of the programmers of the game before they fixed the issue - there were a ton of other bugs too, that I helped get removed before the game was attacked by someone else. No reward money though, but earned some kudos, none-the-less.

[@codechapter6960]

WOW i had to pause the video to actually understand something for the first time. VIDEO IS SO GOOOOOOOOOOD!!!

[@TheSweMaster]

Anyone else who had their Google assistant Google JavaScript for you at 12:23 ?!

[@MaxRoaldEckardt]

You race to the top of my favorite youtubers with videos like these...

[@youtubekackejr.3817]

i was looking at memes how i am here?

[@Jcraft153]

Stay a while, this dude does some cool stuff.

[@NoName-gs9mb]

@@Jcraft153 Is he German, because he sounds so.

[@useodyseeorbitchute9450]

He must be using some unknown exploit in youtube recommend algorithm. ;)

[@hblaub]

Thanks for keeping the Internet safe and us informed and entertained.

[@strayedaway19]

I did not understand a thing but I went along as watching you debug and hack is beautiful and enlightening.

[@cr9pr3]

having paused the video at 2:50 What the browser _should_ do, is saying: "Malformed document. Aborting execution." :P

[@karlkastor]

If they do that a lot of websites won't work. Just run any HTML validator on almost any website and you will get dozens of errors. One of the pains of these web architectures is that they should be backwards compatible and cross-browser.

[@Madinko12]

@@karlkastor yeah, that's why versioning was invented at some point. Just put some "strict" flag, tell non-strict is deprecated and support will be dropped by browsers starting from 2030, don't add new features in permissive mode, and you just improved the web by 999%.

[@cr9pr3]

​@@karlkastor Yes I know. That's why I made the half-ironic :P at the end. I know browser vendors won't do it, because ultimately their product will be the one "that does not work", but in my opinion the idea of accepting a word that isn't in the formal language you are parsing is absolutely insane. I mean we _say_ we use this particular language (html) but in practice every vendor implements a client for a MUCH broader language that isn't even close to the original one. And this behavior isn't even a bug but absolutely intentional. I just don't like it :D

[@Asdayasman]

Karl Kastor Haha, nah. Fuck them.

[@-morrow]

It depends on the what makes the html invalid. e.g. ignoring some mandatory attributes (img alt) may be fine, but guessing/closing tags is just plain evil imho.

[@skysunset877]

I Love It! Your explanation is intuitive and easy. It is very helpful for studying!

[@shantanurauthan9318]

masato did a great job..and you too by explaining the stuff behind the attack.

[@Ikxi]

I don't understand anything but it's still sooooo interesting xD Gutes Video

[@PAhmad99]

Idk how I got here... Idk what's going on. I feel incredibly stupid.

[@jayant9151]

Programmers

[@realcartoongirl]

no

[@PAhmad99]

@@realcartoongirl thx, that explains everything

[@hassankumail1053]

same bro same

[@machinexa1]

Did you guys notice at 0:05, when @LiveOverflow puts quote it says "I put ' it gives bug" (a video by Liveoverflow, easter egg)

[@adityyyaaa]

Actually 🤔

[@prashanthchandrasekar1026]

I thought this was impossible in google search. But this is amazing!!!

[@atharvparlikar8765]

just test

[@theohallenius8882]

HTML has reached a critical mass of bloat that there will always be a XSS vulnerability discovered every year.

[@renakunisaki]

Yeah, it's a real fustercluck. I think there are other tags that parse differently, such as xmp.

[@omri9325]

Feature toggles are there to fix it in the future, you will be able to remove the old browser features that you don't use to prevent potential vulnerabilities.

[@ExEBoss]

At this point, I wish that XML5 would be worked on: github.com/whatwg/html/issues/4436 That would solve a lot of these problems.

[@mattf.2142]

I think it's been on the OWASP top 10 for years. All of the bugs I've found through hackerone, or what have you have been XSS vulnerbilities. Some found within 30 minutes. More like there will be a few XSS vulns discovered every day. (perhaps not on Google, though).

[@theohallenius8882]

@@tf2excession I know, some Intel cpus even have a "god mode" instruction that can execute any instruction, and it wasn't even in the manual, it was probably there for debug purposes and they forgot to remove it.

[@boahneelassmal]

search encrypt as an interesting approach to sanitizing their search requests.... it just takes out any < and > :D

[@vladomaimun]

Browsers should only parse strict and correct HTML.

[@LiEnby]

That would break the internet

[@UltraNyan]

@@LiEnby where are the days of XHTML, those sitty hipster kids with their shitty HTML5 and fancy CSS3

[@IOwnThisHandle]

In a perfect world.

[@LiEnby]

@@UltraNyan what we would like and what we can acturally do are completely different things..

[@kidbomb]

We should at least have the option of only parsing correct HTML. I wouldn't mind having an experimental flag in my browser for it which I could turn on whenever I see fit.

[@gabiold]

Browsers should phase-out HTML correction. If a website requires inserting HTML tags, it should inform the user with some yellow bars at the top like the "prevented to open a window" message. There should be a config option to this like "notify", "ask", "reject", making the notify the default now, then after a year or two, making the "ask" the default, which should be as hard to click through as an invalid TLS cert. window. Really, pages without matching open/close tags and with syntactically bad javascripts are a major thing, errors should really be show up to the users, which will motivate companies to fix their annoying websites, then after a time it should not be allowed to work like nothing happened. No need to be as strict as certain required attribute missing or something semantically wrong trigger it, but if the structural syntax is broken, missing closing tag, closing braket, closing quote or so happens, it should not be rendered to the user at all.

[@LuLeBe]

Nah it will just make users angry at the browser. They don't understand this and they don't have to. Opening up some old forums page from 2005 (which is way more likely to have these issues than sites that are actually still maintained well enough to fix it) is no hazard (unless you download stuff) and yet you wanna show the users all kinds of warnings? Worst idea I've ever heard. On the web, "breaking" stuff is a bad idea. Even just making https the default with warnings for http sites was a major discussion, and that's much less obtrusive than what you propose.

[@gydo1942]

wow. that's crazy! Thanks for explaining man and keep up the good work!

[@xBZZZZyt]

05:30 just parse html with parser library and escape attribute contents and texts and add closing tags and remove comments (do the fixing server-side) like:

[@Mark_1991_1]

Amazing. I said it because i don't know no more words =)

[@IOwnThisHandle]

You clearly don't know English either. No -> know

[@MaheshSingh-de1ix]

That is one historical mutated XSS example that will live on....

[@krzysztof-ws9og]

Is there any benefit of fixing invalid html code? I cannot find any. I think that pages should be blocked by browser.

[@luizzeroxis]

It's less annoying when you just wanna make a quick and dirty page. I don't even use the html, head, and body tags, they don't really have a purpose.

[@TheLolilol321]

We need a "use strict" for html

[@semanticsyntax]

@@luizzeroxis Yeah but quick and dirty pages mean the browser has to guess what you actually meant, and introduces these security issues. Why should your convenience come at the cost of others security? Obviously this isn't just targeted at you, half the web probable contains invalid HTML etc., but if people actually took the time to check their code was well formed then browsers wouldn't have to 'guess', removing an entire class of security exploit.

[@amunak_]

Backwards compatibility. However there should definitely be a mechanism to disable this behaviour, just like we have CORS headers.

[@phasm42]

@@amunak_ The saying used to be, "Be conservative in what you send, be liberal in what you accept". But experience has shown that this leniency in what you accept results in bad data getting incorporated into future versions and standards. It sets up an incentive to make an effort to parse bad data so you're not the program that can't display site X. Over time, it gets rolled into standards.

[@LegacyVision.]

This is a newly exploitable bug due to fixes for IE that were coded incorrectly, so it was never always possible, just a recent change that has been reverted.

[@JochemKuijpers]

Recent change? IE hasn't been updated for years. That bug fix was pretty old too.

[@LegacyVision.]

@@JochemKuijpers incorrect, it was badly coded compatibility fixes made to address rendering for Nintendo switch. It was about 5months in prod before rollback. Edit: my bad english on first comment, I meant Googles js had fixes to address IE compatibility 5/6months ago.

[@fusseldieb]

One day I'll open a LiveOverflow video and suddenly a alert will pop up. One day some random user will make it.

[@probably9085]

I will remember your words

[@Junhexeocara]

i always use markdown to style text inputed by user

[@soneomeelse]

@7:16 It can't be a good sanitizer when there is image object in its template, no matter how good it's on attributes filtering. Strings are to be treated as strings.

[@avileox6304]

Thank for such a great explanation. Keep Posting

[@IOwnThisHandle]

He would regardless of your comment.

[@Rossilaz58]

"Google search is arguably the front page of the Internet" *reddit ceo is angry*

[@Squire3555]

What blows my mind is the bounty he'll probably get on this. XSS in Google's home page is a no-no. Browsers are kind of those weird machines. So much going on.

[@fracasopina2121]

Lol, you're on the money.

[@biabianca6190]

Xss

[@WoolieOG]

Browsers should add support to new optional header, which would fully disable any DOM corrections - for companies like google it only produces problems.

[@nabil.hamawi]

i didn't understand anything but this is amazing

[@zanidd]

interesting exploit, it shows that even big companies can suffer from these things

[@renakunisaki]

A few years ago KZbin had an issue where if you just put two script tags in a row (I think?) one could slip through. Lots of sites also just do a single pass stripping bad tags, which fails when given [scr[script butts]ipt ...]

[@roskelpletnick9660]

Wait... I can get the point of needing styles in HTML emails, there one would need to have some HTML tags. But why did they not just escape any and all unsafe characters in the search bar - you know, replace "

[@LiEnby]

Was thinking the same Google search doesn't let you do custom styling anywhere lol

[@IOwnThisHandle]

Just ...

[@xBZZZZyt]

agree

[@xBZZZZyt]

just why??????

[@KINGSABRI]

wonderful explanation and great catch

[@RoterFruchtZwerg]

I think there is also a problem with the browser reassembling the innerHTML property at 8:35 ... In the DOM view, the is clearly interpreted as attribute-text. However, when reassembled to innerHTML, the attribute-text is not encoded properly. While the DOM contains valid HTML, the reassembled innerHTML does not. I really think the browser should have encoded the attribute-text based on its interpretation of it as text, thus replacing with &lt;/&gt; within innerHTML and returning a valid HTML.

[@LuLeBe]

The browser never automatically escapes HTML entities. If it would, that could break all kinds of sites. Changing behaviour in Browsers is hard, sometimes they have to change the spec instead of fixing a bug xD

[@RoterFruchtZwerg]

@@LuLeBe That's not true. If you set innerText or an attribute (setAttribute) of a DOM element and then somehow ask the browser to the HTML code of this element, the values you've set MUST be properly encoded. I'm pretty surprised however that only quotes get encoded: var tag = document.createElement('b'); tag.setAttribute('attr',''); console.log(tag.outerHTML); //

[@bahai02]

Oh my god! This was really amazing

[@yusufislek3669]

0:05 *flackback* i try put ' it gives bug

[@petermarshall1634]

Just escape the quotes and "greater than"/"less than" tags. Google doesn't need to parse HTML anyways.

[@xBZZZZyt]

agree

[@lucaspelegrino1]

Yeah, it really doesnt make sense to even handle html at that point. But the vulnerability was only possible on the querystring tho, if I understood correctly, there must be a reason for accepting html there.

[@MrSnakeHome]

ist Security Flag GmbH deine eigene Firma? aber cooles Video :D und habe ein Abo da gelassen!

[@MrSnakeHome]

interessantes Video! wenn deine Gedanken wo anders sind! XD

[@4.0.4]

On the one hand, I like that bugs like this exist, it warms my heart to see the extent of human ingenuity. On the other, I wonder how much could be fixed by something like , where anything semi-valid is proactively rejected.

[@danielchin1259]

This blows my mind

[@MattZelda]

Can confirm that this also works on Firefox version: 66.0.2 (64-bit)

[@Sunnywastakentoo]

0:00 REDDIT WANTS TO KNOW YOUR LOCATION

[@IOwnThisHandle]

What a loser.

[@klyplays]

How come the biggest tech companies still get these kind of errors?

[@sjoerdo6988]

It seems rather close to April first for something like this to happen

[@lordtylus9262]

Hello, thank you for the very informative video, it was well explained, but I havent quite grasp the point about the XSS problem in that case. I see that you basically alter the HTML of the server to get some JavaScript executed. But as long as you dont get googles servers to execute that it should be relatively harmless right? You could even use like ctrl+shift+i in google Chrome to get your browers debugging and can change any HTML attribute add Scripts and what not which would get to the same result. As you have shown in the video. I am aware that if you happen to be able get your scripts embedded into the youtube comment section by just posting it there it will be executed by the clients of every user that watches the comments. So this indeed is a huge problem. But what exactly do you gain by executing java script on your client in your googles search bar? Because there is only you who would see it. Sending someone a link similar to what you got at the start of the video is of course an option, but so would any other link of a site you have control over. with a similar looking URL also its not quite seamless as you had to click into the search bar to get it executed. could you or someone else please explain it to me?

[@itaybron]

Me: - not knowing dick about programming - KZbin: yo watch this video about programming.

[@nikhilkamble4210]

Want to learn more about xss. Please upload some more videos on critical xss bugs

[@scaslx]

Your video blows my mind

[@winstonlopez6117]

Im pretty new to all this but from what can follow. The writes the script in a way that the paser fixs rewrites the script. Now the wbsite thinks its okay put it just help script to work and take over .

[@M1stersupersonic8]

"Google is arguably the front page of the internet" Reddit would to have a word with you.

[@tormenmashi_]

PFFT

[@berthold64]

epic upbboated xD edit: thanks for the gold sir

[@alevfalse7963]

r/ihavereddit

[@4strokeperro949]

0:00 _Reddit has left the chat_

[@concernedcitizen3254]

Am I right in saying search engines are in an unusual position in that they are meant to allow for users to search for code online, therefore must accept the characters. Many sites could just block these inputs.

[@RoterFruchtZwerg]

That's indeed mindblowing, thank you for sharing this with us :) But what I don't get is, why is google using this sanitizer at all in this case? I'm not aware that the search input requires partial parsing, it should be shown as plain text everywhere and this should be simple to escape... Where is this needed?

[@renakunisaki]

That's what it's trying to do, display user input as plain text. Unfortunately it wants to then add styles to that text, which complicates things...

[@mohamedhassanqeyru852]

Qeyruu maxamad xasan cabdi@com

[@mohamedhassanqeyru852]

@@renakunisaki yutob+com00252615196122

[@mohamedhassanqeyru852]

@@renakunisaki qeyruu maxamad xasan cabdi@com

[@AbdelrahmanRashed]

why do we still have XSS Vulnerabilities in 2019 ?

[@fmattia99]

Because HTML is bloated, XSS is one of the vulnerabilities that still happens because of a reason, SQL Injections for example are easy to avoid, and they happen only when programmers knows nothing about security, but until we will replace HTML with something less bloated and maybe a little bit more strict, we will have XSS

[@renakunisaki]

Because the web is a huge pile of spaghetti and legacy cruft that's become so bloated and complex that it's impossible to do correctly.

[@rianhasiando]

But, can i just do htmlspecialchars() to prevent it ??

[@derelictmanchester8745]

Good tutorial, interesting title music...who is it BTW?...👍👍👍👍👍

[@Napert]

Why not use xhtml so if something breaks you don't get anything at all?

[@dnns1896]

So maybe I missunderstood something, but why is it possible to enter HTML inside the Google Search bar that gets interpreted somehow? Is there any valid reason? From a Search Engine I expect, that everything that is entered in the search field gets "interpreted" as Text I am searching for. And the example with Webmailers shows me, that we definitely need a different Standard for those types of Input, that is not HTML. Something like Markdown or so. But not HTML that can cause Problems in Browsers.

[@dnns1896]

@Michael Murphy But why the heck is google still trying to do so? That doesn't make any sense to me. Because from how I understood that, by default the text inside a input field is not interpreted anyway.

[@powershellaxp64]

0:05 I put ' it gives bug

[@JJ-hl5zi]

Humans still working on google, don´t expect everything to be perfect...

[@martint1775]

Isn't there like a big bounty on exploiting Google? Did he get any money?

[@brod515]

3:36 I don't know much of anything about html or web But why is the browser trying to fix invalid HTML. If I put an incorrect account number to my bank, my bank doesn't try to fix it and say "did you mean this"

[@MarineFocus]

Not a very good developer myself, but it works on a "better than nothing" principle. Tons of tags in a HTML document so it's pretty easy to trip up and make mistakes. Imagine missing a single tag somewhere in a big company's website and having the browser display nothing (or garbage) because of the error? Thus browsers try to compensate for human mistakes, which happens all the time.

[@kesuskim6072]

dude... seriously... this is sick lol fabulous insight

[@thebosscrystal]

Can this be used for malicious stuff?

[@XYNOMS]

@LiveOverflow, Very convincing ;)

[@gosunov]

[@スープ-i5v]

you're welcome

[@abastrax8228]

Chexmixx Memes stolen

[@スープ-i5v]

@@abastrax8228 really??

[@jonmayer]

Was the commit part of some attempt to hack the Nintendo switch and needed to add some small vulnerability to pull it off?

[@mpeppelman]

I think that's unlikely. Unless a high level part of the switch such as the main menu functions like a browser and runs javascript, there is no reason to do it that way. Using this attack on lower level should just leave it sandboxed off, and things that aren't sand boxed off usually restrict user input, so the chance you could actualy input the code for the XSS is basically 0. And that is all assuming that Nintendo uses the google javascript library in the first place.

[@laurinneff4304]

I‘ve just found a XSS bug in my dad‘s website: He‘s a photographer and has an image archive on his website. This archive has a search feature where you just need to enter something like alert(1) to run JS

[@asianpuppy2080]

if it is a small website its not a big issue considering its only a reflected xss, try finding a stored xss on his site

[@bjornroesbeke]

I understand this code completely but would've never thought of trying to use an exploit like this. It's just not something you think about if you're "just" a developer. When you keep asking yourself "what if...", you'll eventually stumble upon weird quirks like this.

[@Dragiux]

A lot of these issues come from browsers not being strict in parsing HTML, at some points even modifying it to make it "work". "use strict" for html, when?

[@xBZZZZyt]

Why did Google do sanitizing for search field that just wants plain text (not any html tags)?

[@moto_venom]

@LiveOverflow what is the best way to protect the message form from xss?

[@nikhilkamble4210]

Very helpful 👍

[@JohnRunyon]

The parsing of the div inside the script is bizarre to me. The closing script tag is inside a string literal, but it's still seen as a closing script tag?!