blob: 17cdc2f8c8010a130150ab33f9ee2ae3a6fc68c2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
<!DOCTYPE html>
<html>
<head>
<script>
function jsfuzzer() {
document.execCommand("outdent", false);
}
function eventhandler2() {
document.execCommand("styleWithCSS", false, true);
}
function eventhandler3() {
document.execCommand("delete", false);
var element1 = document.getElementById("element1");
document.getSelection().setPosition(element1, 0);
var element1 = document.getElementById("element2");
element2.ownerDocument.execCommand("insertOrderedList", false);
var element1 = document.getElementById("element3");
element3.addEventListener("DOMSubtreeModified", eventhandler3);
document.activeElement.setAttribute("contenteditable", "true");
}
</script>
</head>
<body onload=jsfuzzer()>
<i id="element1">
<audio i src="x"></audio>
<da id="element2">
<br id="element3" style="">
<svg onload="eventhandler3()">
<animate onbegin="eventhandler2()">
<body>
</html>
|
