img
Typical HTML element which can carry XSS Payloads in Event handlers.
• HTML5 added new ways to include special content on web pages, like graphics with <svg> or math formulas with <math>. These elements are treated differently by web browsers than regular HTML, which means they follow their own set of rules and have their own namespace.
• I have retrieved elements with their behaviour towards mutation from the paper Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials.
Typical HTML element which can carry XSS Payloads in Event handlers.
Typical HTML element which can carry XSS Payloads.
SCRIPT tag is an rawtext element,it cannot contain other elements in between.
In HTML treated as img, valid SVG or MathML element.
it's treated as an unknown element unless used inside svg where it's part of SVG, not HTML.
By default, the element's content is not rendered,Can render content in other SVG or MathML namespaces.
A built-in template element serves as a storage for HTML markup templates. The browser ignores its contents, only checks for syntax validity, but we can access and use it in JavaScript, to create other elements.
Basic HTML element,terminate foreign content.
Details here
Basic HTML element.
Embeds external files like SVG, PDF, or HTML. Supports fallback content.
Form elements cannot be nested enforced by parsing specification.
Details here
Both cannot be nested,not enforced by parsing specification.
Details here
Terminates foreign content,optional end tag.
Details here
No end tag, no content allowed,terminate foreign content.
Details here
No end tag,no content allowed.
Details here
No interactive content allowed,example : iframe,not enforced by parsing sepcification.
Details here
Parsed differently depending on scripting flag : either HTML or javascript content.
Details here
Open's a table,parsing specification enforces no nesting,terminates foreign content.
Details here
Restrictive content,together they make up a table.
Details here
Only option,optgroup and script supporting content are allowed,special parsing rules when inside table.
Details here
Restriction on where it can occur,depending on attribute values allwed content changes.
Details here
Only text content.
Details here
Not supported anymore,no content,no end tag.
Details here
No element specification anymore,still has parsing rules,used to render markup as text without executing it.
Details here
No element specification anymore,still has parsing rules.
Details here
Make up a list,allowed to contain script supporting elements,terminate foreign content.
Details here
Only allowed to contain phrasing content,terminate foreign content.
Details here
Restricted content model,terminates foreign content.
Details here
Shall only occur inside dl,terminates foreign content.
Details here
Deprecated.Renders everything below as plain text,can not be closed.
Details here
No element specification anymore,still have parsing rules,contain raw text element.
Details here
Iframe element specification says no content allowed,but parsing specification says raw text content.
Details here
Namespace transition from HTML to SVG.
Details here
Allow to embed HTML segments inside a SVG.
Details here
Namespace transistion from HTML to MathML.
Details here
Allow to embed HTML segments inside MathML.
Details here
Text content when in HTML,otherwise markup.
Deprecated for both HTML and SVG.
Details here
HTML namespace - text content,singleton: not enforced by parsing specification.
SVG namespace - can contain markup.
Details here