# QA-15, MIM-12, MIM-13, MIM-16: elements removed with their content, event handlers
# matched by prefix, and the document wrapper the fragment must not carry.

== mim12-script
expect: no-element=script no-text=alert keeps-text=SAFE
--
<script>alert(1)</script>SAFE

== mim12-script-src
expect: no-element=script keeps-text=SAFE
--
<script src="https://e.test/x.js"></script>SAFE

== mim12-style
expect: no-element=style no-text=STYLECONTENT keeps-text=SAFE
--
<style>p{color:red} /* STYLECONTENT */</style>SAFE

== mim12-iframe
expect: no-element=iframe no-text=IFRAMECONTENT no-attr=srcdoc keeps-text=SAFE
--
<iframe src="https://e.test/" srcdoc="&lt;script&gt;alert(1)&lt;/script&gt;">IFRAMECONTENT</iframe>SAFE

== mim12-frame
expect: no-element=frame no-element=frameset keeps-text=SAFE
--
<frameset><frame src="https://e.test/"></frameset>SAFE

== mim12-object
expect: no-element=object no-element=param no-text=OBJECTCONTENT keeps-text=SAFE
--
<object type="text/html" data="https://e.test/"><param name="src" value="https://e.test/">OBJECTCONTENT</object>SAFE

== mim12-embed
expect: no-element=embed keeps-text=SAFE
--
<embed src="https://e.test/x.swf" allowscriptaccess="always">SAFE

== mim12-applet
expect: no-element=applet no-text=APPLETCONTENT keeps-text=SAFE
--
<applet code="X.class" codebase="https://e.test/">APPLETCONTENT</applet>SAFE

== mim12-form
expect: no-element=form no-text=FORMCONTENT keeps-text=SAFE
--
<form action="https://e.test/steal" method="post">FORMCONTENT<input name="password" type="password"></form>SAFE

== mim12-input
expect: no-element=input keeps-text=SAFE
--
<input type="text" value="x" autofocus onfocus="alert(1)">SAFE

== mim12-button
expect: no-element=button no-text=BUTTONCONTENT keeps-text=SAFE
--
<button formaction="https://e.test/">BUTTONCONTENT</button>SAFE

== mim12-select
expect: no-element=select no-element=option no-text=SELECTCONTENT keeps-text=SAFE
--
<select><option>SELECTCONTENT</option></select>SAFE

== mim12-textarea
expect: no-element=textarea no-text=TEXTAREACONTENT keeps-text=SAFE
--
<textarea>TEXTAREACONTENT</textarea>SAFE

== mim12-meta
expect: no-element=meta keeps-text=SAFE
--
<meta name="viewport" content="width=device-width">SAFE

== mim12-link
expect: no-element=link keeps-text=SAFE
--
<link rel="stylesheet" href="https://e.test/a.css">SAFE

== mim12-base
expect: no-element=base keeps-text=SAFE
--
<base href="https://e.test/">SAFE

== mim12-template
expect: no-element=template no-text=TEMPLATECONTENT keeps-text=SAFE
--
<template>TEMPLATECONTENT</template>SAFE

== mim12-noscript
expect: no-element=noscript no-text=NOSCRIPTCONTENT keeps-text=SAFE
--
<noscript>NOSCRIPTCONTENT</noscript>SAFE

== mim16-math
expect: no-element=math no-element=mi no-text=MATHCONTENT keeps-text=SAFE
--
<math><mi>MATHCONTENT</mi></math>SAFE

== mim16-svg
expect: no-element=svg no-element=text no-text=SVGCONTENT keeps-text=SAFE
--
<svg width="10" height="10"><text>SVGCONTENT</text></svg>SAFE

== mim12-all-nested
source: the content-dropped elements nested in each other
expect: no-text=NESTED keeps-text=SAFE
--
<form><select><template><noscript><svg><math><object><applet><button><textarea>NESTED</textarea></button></applet></object></math></svg></noscript></template></select></form>SAFE

== mim12-uppercase
expect: no-element=script no-element=iframe no-text=alert keeps-text=SAFE
--
<SCRIPT>alert(1)</SCRIPT><IfRaMe>alert(2)</IfRaMe>SAFE

== mim13-onerror
expect: no-attr=onerror keeps-text=SAFE
--
<img src="cid:a@b" onerror="alert(1)">SAFE

== mim13-onload-body
expect: no-attr=onload no-element=body keeps-text=SAFE
--
<body onload="alert(1)">SAFE</body>

== mim13-mixed-case
expect: no-attr=onclick keeps-text=SAFE
--
<p oNcLiCk="alert(1)" ONMOUSEOVER="alert(2)">SAFE</p>

== mim13-unknown-handler
source: a prefix check catches handlers no list has heard of
expect: keeps-text=SAFE
--
<p onbeforexyz="alert(1)" onanimationstart="alert(2)" onpointerrawupdate="alert(3)" onbegin="alert(4)" on="x" onx="y">SAFE</p>

== mim13-ontoggle-details
source: PortSwigger cheat sheet (details ontoggle)
expect: no-attr=ontoggle keeps-text=SAFE
--
<details open ontoggle="alert(1)"><summary>SAFE</summary></details>

== mim13-handler-slash-separator
expect: keeps-text=SAFE
--
<img/src="cid:a@b"/onerror="alert(1)">SAFE<p/onclick=alert(1)>x</p>

== mim13-handler-nul-in-name
expect: keeps-text=SAFE
--
<p on\x{0}click="alert(1)">SAFE</p>

== mim13-handler-on-every-allowed-element
expect: keeps-text=SAFE
--
<a onclick=1>a</a><b onclick=1>b</b><div onclick=1>d</div><table onclick=1><tr onclick=1><td onclick=1>SAFE</td></tr></table><span onclick=1>s</span><font onclick=1>f</font><img src="cid:a@b" onclick=1>

== wrapper-document
expect: no-element=html no-element=head no-element=body no-element=title no-text=TITLECONTENT keeps-text=SAFE
--
<!DOCTYPE html><html><head><title>TITLECONTENT</title></head><body><p>SAFE</p></body></html>

== legacy-elements
expect: no-element=bgsound no-element=layer no-element=ilayer no-element=xml no-element=keygen keeps-text=SAFE
--
<bgsound src="https://e.test/a.mid"><layer src="https://e.test/"></layer><ilayer src="https://e.test/"></ilayer><xml src="https://e.test/x.xml"></xml><keygen>SAFE

== media-elements
expect: no-element=audio no-element=video no-element=source no-element=track no-element=picture no-element=canvas keeps-text=SAFE
--
<audio src="https://e.test/a.mp3" autoplay></audio><video src="https://e.test/v.mp4" autoplay><track src="https://e.test/t.vtt"></video><picture><source srcset="https://e.test/a.webp"></picture><canvas></canvas>SAFE

== portal-dialog-slot
expect: no-element=portal no-element=dialog no-element=slot keeps-text=SAFE
--
<portal src="https://e.test/"></portal><dialog open>d</dialog><slot>s</slot>SAFE

== target-and-rel
source: a link may not choose its own window or relationship
expect: no-attr=target keeps-text=SAFE has-attr=href
--
<a href="https://e.test/" target="_top" rel="opener">SAFE</a>

== xmlns-attributes
expect: no-attr=xmlns no-attr=xmlns:xlink keeps-text=SAFE
--
<div xmlns="http://www.w3.org/1999/xhtml" xmlns:xlink="http://www.w3.org/1999/xlink">SAFE</div>

== benign-newsletter
source: a plain styled newsletter: the pipeline must keep its content and links
expect: keeps-text=Weekly has-element=table has-element=a has-attr=href remote=1 slot-refs=1
--
<table width="600" cellpadding="0" cellspacing="0" border="0" align="center" bgcolor="#ffffff"><tr><td style="font-family:Arial,sans-serif;font-size:14px;color:#333333;padding:10px"><h1 style="color:#0055aa">Weekly</h1><p>Hello <b>reader</b>, here is <a href="https://news.example.test/a?id=1">the article</a>.</p><img src="https://news.example.test/hero.png" width="600" height="200" alt="hero"></td></tr></table>
