MUTATION SNIPER

HTML5 added new ways to include special content on web pages, like graphics with <svg> or math formulas with <math>. These elements are treated differently by web browsers than regular HTML, which means they follow their own set of rules and have their own namespace.

• I have retrieved elements with their behaviour towards mutation from the paper Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials.



img

Typical HTML element which can carry XSS Payloads in Event handlers.

IMG tag is an void element,it does not require a closing tag while parsing!

script

Typical HTML element which can carry XSS Payloads.

SCRIPT tag is an rawtext element,it cannot contain other elements in between.

image

In HTML treated as img, valid SVG or MathML element.

it's treated as an unknown element unless used inside svg where it's part of SVG, not HTML.

template

By default, the element's content is not rendered,Can render content in other SVG or MathML namespaces.

A built-in template element serves as a storage for HTML markup templates. The browser ignores its contents, only checks for syntax validity, but we can access and use it in JavaScript, to create other elements.

div,span

Basic HTML element,terminate foreign content.

Details here

object

Basic HTML element.

Embeds external files like SVG, PDF, or HTML. Supports fallback content.

form

Form elements cannot be nested enforced by parsing specification.

Details here

dfn,header

Both cannot be nested,not enforced by parsing specification.

Details here

p

Terminates foreign content,optional end tag.

Details here

br,embed

No end tag, no content allowed,terminate foreign content.

Details here

input

No end tag,no content allowed.

Details here

a

No interactive content allowed,example : iframe,not enforced by parsing sepcification.

Details here

noscript

Parsed differently depending on scripting flag : either HTML or javascript content.

Details here

table

Open's a table,parsing specification enforces no nesting,terminates foreign content.

Details here

td,tr,colgroup

Restrictive content,together they make up a table.

Details here

select

Only option,optgroup and script supporting content are allowed,special parsing rules when inside table.

Details here

option

Restriction on where it can occur,depending on attribute values allwed content changes.

Details here

textarea

Only text content.

Details here

keygen

Not supported anymore,no content,no end tag.

Details here

xmp

No element specification anymore,still has parsing rules,used to render markup as text without executing it.

Details here

frameset

No element specification anymore,still has parsing rules.

Details here

li,ul

Make up a list,allowed to contain script supporting elements,terminate foreign content.

Details here

pre,var

Only allowed to contain phrasing content,terminate foreign content.

Details here

dl

Restricted content model,terminates foreign content.

Details here

dt

Shall only occur inside dl,terminates foreign content.

Details here

plaintext

Deprecated.Renders everything below as plain text,can not be closed.

Details here

noframes,noembed

No element specification anymore,still have parsing rules,contain raw text element.

Details here

iframe

Iframe element specification says no content allowed,but parsing specification says raw text content.

Details here

svg

Namespace transition from HTML to SVG.

Details here

foreignObject

desc,path

Allow to embed HTML segments inside a SVG.

Details here

math

Namespace transistion from HTML to MathML.

Details here

mi,mo,mn,mtext

mglyph,ms,mtext

annotation-xml,malignmark

Allow to embed HTML segments inside MathML.

Details here

style,font

Text content when in HTML,otherwise markup.

Deprecated for both HTML and SVG.

Details here

title

HTML namespace - text content,singleton: not enforced by parsing specification.

SVG namespace - can contain markup.

Details here