blob: 19cc205b9195cdf6c7370424c09e5a6d9f95ec94 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
<!DOCTYPE html>
<html>
<head>
<script type="text/javascript">
function boom()
{
var table = document.createElement("table");
document.body.appendChild(table);
table.contentEditable = "true";
table.focus();
try {
// This will throw, since it's attempting to inject a list inside a table
document.execCommand("insertunorderedlist", false, null);
} catch (e) {}
}
</script>
</head>
<body onload="boom();"></body>
</html>
|
