const xssTestVectors = [ // Basic Script Injection ``, ``, ``, // IMG Tag Attacks ``, ``, ``, ``, // SVG Attacks ``, ``, ``, // Event Handler Attacks ``, `Click me`, ``, `test`, `test`, `Click`, // Link/Anchor Attacks `Click`, `Click`, `Click`, `Click`, // Style Attribute Attacks ``, ``, ``, // Meta Tag Attacks ``, ``, // Form Attacks ``, `Submit`, // Iframe Attacks ``, ``, // Object/Embed Attacks ``, ``, // Encoded Attacks ``, ``, `Click`, // Data URI Attacks `Click`, ``, // Base64 Encoded ``, // Protocol Handlers `Click`, `Click`, // Comments and CDATA ``, `alert('XSS')]]>`, // Malformed Tags ``, `ript>alert('XSS')ript>`, `<`, // Case Variations ``, ``, ``, // Null Bytes and Special Characters ``, `alert('XSS')`, // Multiple Vectors in One `Click`, // CSS Expression (IE specific) ``, // HTML5 Specific ``, ``, ``, // Mutation XSS ``, // DOM Clobbering ``, ]; // Function to test sanitization function testSanitization(sanitizeFunction) { console.log('Testing XSS Prevention...\n'); let passed = 0; let failed = 0; xssTestVectors.forEach((vector, index) => { const sanitized = sanitizeFunction(vector); // Check if common XSS indicators are present in sanitized output const hasScript = /
`, // DOM Clobbering `