loading code fetching the highlighted snippet
FIG-001/ AGENT
agent output.
A simulated agent streams a PR-review response mixing legitimate rich HTML (verdict box, findings table, real link) with deliberate XSS attempts — javascript: URLs, onerror / onclick / onsubmit handlers, a vbscript: protocol, a form posting to javascript:. Watch the source, the sanitized render, and the audit log fill in together.
- Sanitization happens at the
Parserlayer — custom renderers and snippets cannot bypass it. - The URL allowlist covers
javascript:,vbscript:,data:(where unsafe), and other dangerous protocols. - Inline event handlers (
onclick,onerror,onsubmit, …) andsrcdocare stripped before render. - Streaming-aware — every chunk is sanitized as it arrives, not after the document completes.
SRC / AGENT STREAM
// agent response will arrive here word by word.
OUT / RENDERED
click "start" to render the simulated agent response.
BLOCKED / SANITIZATION LOG
nothing blocked yet — the log fills in as malicious payloads stream in.
category · agent
sheet · sheet 01 / 01
⟳ to re-run