DOMPurify is integrated within the ModSecurity WAF XSS Evasion Demo here -
http://www.modsecurity.org/demo/demo-deny-noescape.html
Here is an example link that injects DOMPurify in the response -
http://www.modsecurity.org/demo/demo-deny-noescape.html?test=%3Cscript&enable_dompurify_defense=on&disable_browser_xss_defense=on
Notice that the CSS data does not render properly. Mario mentioned the following -
"Known issue is <style> being the first element, will go to doc.head instead doc.body. Which is even correct by spec, a config flag will fix that soon. Style attributes however are supposed to work."
DOMPurify is integrated within the ModSecurity WAF XSS Evasion Demo here -
http://www.modsecurity.org/demo/demo-deny-noescape.html
Here is an example link that injects DOMPurify in the response -
http://www.modsecurity.org/demo/demo-deny-noescape.html?test=%3Cscript&enable_dompurify_defense=on&disable_browser_xss_defense=on
Notice that the CSS data does not render properly. Mario mentioned the following -
"Known issue is <style> being the first element, will go to doc.head instead doc.body. Which is even correct by spec, a config flag will fix that soon. Style attributes however are supposed to work."