What's in a tag name? JavaScript, apparently

A reporter delved into the topic of what characters are permissible in a tag name while watching television. Initially, it was known that tag names had to commence with a-zA-Z, but the reporter sought to explore further possibilities. Attempting to place alert(1) in the tag name, the browser automatically converted it to uppercase.

This prompted the reporter to investigate if other properties existed that did not perform the same uppercase conversion. By assigning an id attribute and inspecting it in DevTools with console.dir(x), the lowercase version of the tag name appeared in the localName property. This provided a solid foundation for the reporter to build upon.

The reporter combined this knowledge with the ability to make any tag focusable using tabindex and chaining the onfocus event with itself. By writing a string to the event handler via attributes[0].value, the string was converted into a function and could then be called using new. This proved to be a shocking revelation, as it worked in every browser.

The reporter continued exploring this avenue, testing various transformations of the tag name. It was found that alphabetic characters, forward slashes, whitespace, and newlines were all transformed. However, line and paragraph separator characters remained untouched and acted like newlines in JavaScript. This led to the discovery of bizarre-looking vectors that could be created.

With attributes[0].value potentially blocked, the reporter sought alternative methods. They experimented with the HTML, incorporating an opening angle bracket into the tag name and combining it with the first attribute to produce an XSS vector. Further experimentation with attributes like part, which converts space-separated values into an array, allowed the reporter to extract the onfocus(event) portion, overwrite the event variable with the payload, and replace the onfocus variable with the Function constructor.

This resulted in the lowercase tag name being passed to eval and executed as JavaScript. The reporter shared this discovery with Sol 5.6, who generated interesting variants. The reporter also uncovered the getAttributeNode function and the setHTMLUnsafe function, both of which were previously forgotten. Finally, the reporter found a variant of the part attribute vector that utilized classList instead.

Initially, this investigation was a simple inquiry about valid tag name characters. However, it evolved into a realization that browsers exhibit more leniency than anticipated. Tags can transform into JavaScript payloads, URLs, or even fresh markup. The lesson learned is that seemingly harmless properties such as localName, part, and classList can serve as unexpected hiding spots for payloads and transformations capable of bypassing blocklists and WAF signatures.