16 lines
500 B
HTML
16 lines
500 B
HTML
<!doctype html>
|
|
<html></html>
|
|
<head></head>
|
|
<base href="https://evil.example/">
|
|
<script>alert('unsafe')</script>
|
|
<link rel="stylesheet" href="/site.css">
|
|
</head>
|
|
<body onload="bad()">
|
|
<form action="/send"><input name="secret"></form>
|
|
<iframe src="https://evil.example/frame"></iframe>
|
|
<a href="javascript:bad()" onclick="bad()">Event</a>
|
|
<img src="/image.jpg">
|
|
<article id="event-12345" class="event card"><h2 class="title">Safe</h2></article>
|
|
</body>
|
|
</html>
|