Highcharts test tool

by Torstein Hønsi

HTML

<script src="https://code.highcharts.com/8.1.0/highcharts.js"></script>

<div id="container"></div>

CSS

#container {
    min-width: 300px;
    max-width: 800px;
    height: 300px;
    margin: 1em auto;
}

JavaScript

Highcharts.chart('container', {
    title: {
        text: 'Scripts should not run from config'
    },
    subtitle: {
        text: '1. JavaScript injected in plain href: <a href=\'#";alert("XSS 1");var fake="\'>Click here</a><br>' +
        '2. JavaScript injected as href="javascript:...": <a href="javascript:alert(\'XSS 2\')">Click here</a><br>'
    }
});