https://securitum.com
Even if comments were stripped (which sometimes happens), you could still put it in the URL or font family name: * { font-family: '</math>...'; }
This would work and this something that Angular DomSanitizer does [1]. But I personally am not a big fan of this solution as it has large performance penalty if the sanitized string is huge. [1]…
Hey, I'm the author of the write-up. Nice to see my research here! If you have any questions, please let me know.
Even if comments were stripped (which sometimes happens), you could still put it in the URL or font family name: * { font-family: '</math>...'; }
This would work and this something that Angular DomSanitizer does [1]. But I personally am not a big fan of this solution as it has large performance penalty if the sanitized string is huge. [1]…
Hey, I'm the author of the write-up. Nice to see my research here! If you have any questions, please let me know.