blob: 769f62f648a88fa6ac3562a42345d68e62d90787 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
<!DOCTYPE html>
<html>
<head>
<title>document.write() from script-inserted inline scripts and script@onload</title>
</head>
<body>
1
<script>
function write(num) {
document.write(num + " ");
}
function scriptload() {
document.write("\u003Cscript src='data:text/javascript,write(9)'>\u003C/script> 10 \u003Cscript>write(11)\u003C/script>");
write(12);
}
function scripterror() {
document.write("\u003Cscript src='data:text/javascript,write(16)'>\u003C/script> 17 \u003Cscript>write(18)\u003C/script>");
write(19);
}
write(2);
document.write("\u003Cscript src='data:text/javascript,write(3)'>\u003C/script> 4 \u003Cscript>write(5)\u003C/script>");
var s = document.createElement("script");
s.textContent = "write(6)";
document.body.appendChild(s);
write(7);
document.write("\u003Cscript src='data:text/javascript,write(8)' onload='scriptload()'>\u003C/script> 13 \u003Cscript>write(14)\u003C/script>");
write(15);
document.write(`\u003Cscript src='nosuchscriptoutthere.js' onload='write("fail")' onerror='scripterror()'>\u003C/script> 20 \u003Cscript>write(21)\u003C/script>`);
write(22);
</script>
</body>
</html>
|
