]/i', // JavaScript / VBScript / LiveScript protocol — tolerates whitespace within keyword // (browsers accept `java\tscript:` in href attributes; livescript: is the legacy Netscape scheme name). '/(?:java\s*script|vb\s*script|live\s*script)\s*:/i', // Data URI with executable content types. '/data\s*:\s*(?:text\/html|application\/(?:x-)?javascript|text\/javascript)/i', // JS execution functions. '/\b(?:eval|settimeout|setinterval)\s*\(/i', // CSS expression (IE legacy, still relevant). '/expression\s*\(/i', // DOM access for data exfiltration / redirect. '/\bdocument\s*\.\s*(?:cookie|write|writeln|location|domain)/i', '/\bwindow\s*\.\s*(?:location|open|navigate)/i', // DOM sink assignment (CRS 941180, PHPIDS #37, NinjaFirewall). '/\b(?:inner|outer)html\s*=/i', '/\binsertadjacenthtml\s*\(/i', // String.fromCharCode — payload construction without literal tags // (CRS 941390, PHPIDS #43, voku/anti-xss). '/string\s*\.\s*fromcharcode\s*\(/i', // Constructor chain execution. '/constructor\s*[\[\(]/i', // CSS url() with JS protocol. '/url\s*\(\s*(?:javascript|data\s*:\s*text\/html)/i', // ESI injection (observed in CH production fleet data). '/<\s*esi\s*:/i', ); /** * Event-handler shape gate (cheap pre-filter). * * Matches anything shaped like an HTML event handler attribute * (`on=`) independent of whether `name` is a real handler. Used * as a cost-bound gate before the precise allow-list — with no `on…=` * token in the body we skip the 100+ alternative allow-list entirely, * which dominates per-request cost on ARGS scans. * * Name is bounded [a-z]{2,24} to match all real HTML handlers while * keeping PCRE work linear in input length. * * @var string */ const XSS_EVENT_HANDLER_SHAPE_GATE = '/\bon[a-z]{2,24}\s*=/i'; /** * Event-handler precise allow-list. * * Evaluated only when XSS_EVENT_HANDLER_SHAPE_GATE fires. Covers the * AB-validated production set, CRS 941160 HTML5 handlers (onmessage, * onstorage, onpageshow), and the imunify-connect port's form / * clipboard / media handlers (onabort, oninvalid, onreset, oncopy, * oncut, onpaste, onloadstart, onsearch, oncancel, onclose, * onauxclick). This pattern is the sole catch-all for ``/ * `