MUTATION SNIPER

HTML5 added new ways to include special content on web pages, like graphics with <svg> or math formulas with <math>. These elements are treated differently by web browsers than regular HTML, which means they follow their own set of rules and have their own namespace.

• I have retrieved elements with their behaviour towards mutation from the paper Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials.



img

Typical HTML element which can carry XSS Payloads.

script

Typical HTML element which can carry XSS Payloads.

image

In HTML treated as img, valid SVG or MathML element.

template

By default, the element's content is not rendered,Can render content in other SVG or MathML namespaces.

div,span

Basic HTML element,terminate foreign content.

object

Basic HTML element.

form

Form elements cannot be nested enforced by parsing specification.

dfn,header

Both cannot be nested,not enforced by parsing specification.

p

Terminates foreign content,optional end tag.

br,embed

No end tag, no content allowed,terminate foreign content.

input

No end tag,no content allowed.

a

No interactive content allowed,example : iframe,not enforced by parsing sepcification.

noscript

Parsed differently depending on scripting flag : either HTML or javascript content.

table

Open's a table,parsing specification enforces no nesting,terminates foreign content.

td,tr,colgroup

Restrictive content,together they make up a table.

select

Only option,optgroup and script supporting content are allowed,special parsing rules when inside table.

option

Restriction on where it can occur,depending on attribute values allwed content changes.

textarea

Only text content.

keygen

Not supported anymore,no content,no end tag.

xmp

No element specification anymore,still has parsing rules,used to render markup as text without executing it.

frameset

No element specification anymore,still has parsing rules.

li,ul

Make up a list,allowed to contain script supporting elements,terminate foreign content.

pre,var

Only allowed to contain phrasing content,terminate foreign content.

dl

Restricted content model,terminates foreign content.

dt

Shall only occur inside dl,terminates foreign content.

plaintext

Deprecated.Renders everything below as plain text,can not be closed.

noframes,noembed

No element specification anymore,still have parsing rules,contain raw text element.

iframe

Iframe element specification says no content allowed,but parsing specification says raw text content.

svg

Namespace transition from HTML to SVG.

foreignObject

desc,path

Allow to embed HTML segments inside a SVG.

math

Namespace transistion from HTML to MathML.

mi,mo,mn,mtext

mglyph,ms,mtext

annotation-xml,malignmark

Allow to embed HTML segments inside MathML.

style,font

Text content when in HTML,otherwise markup.

Deprecated for both HTML and SVG.

title

HTML namespace - text content,singleton: not enforced by parsing specification.

SVG namespace - can contain markup.