HTMLPurifier Variable Width Attack Smoketest

For more information, see Cheng Peng Su's original advisory. This particular exploit code appears only to work in Internet Explorer, if it works at all.

Test

A"'; // in our out the attribute? ;-) $html .= "onerror=alert('$i')>O"; $pure_html = $purifier->purify($html); ?>

ASCII	Raw	Output	Render

Analysis

This test currently passes the XSS aspect but fails the validation aspect due to generalized encoding issues. An augmented UTF-8 smoketest is pending, until then, consider this a pass.