Inline JS with html-entities context

[tank1st99]

The library incorrectly resolves contexts with HTML-entities inside the inlined JS-code.

False Positive:
Format String:
<a href="#" onclick="alert(&quot;{0}&quot;);">test</a>
Payload:
False Positive

XSS 1:
Format String:
<a href='#' onclick='alert(&quot;"{0}"&quot;);'>XSS</a>
Payload:
+alert(2)+

XSS 2:
Format String:
<a href="#" onclick='alert("Tom&{0}");'>XSS?</a>
Payload:
quot;);alert(2);//

[kochetkov]

The bug is confirmed. Please contact me at vkochetkov@ptsecurity.com to get information on receiving prizes.