Fix #545: Add support for HTML5 pointer and transition event handlers

src/main/java/utils/FindXSS.java

@@ -160,7 +160,27 @@ public class FindXSS {
     "onvolumechange",
     "onwaiting",
     "onshow",
-    "ontoggle"
+    "ontoggle",
+    "onpointerdown",
+    "onpointerup",
+    "onpointercancel",
+    "onpointermove",
+    "onpointerover",
+    "onpointerout",
+    "onpointerenter",
+    "onpointerleave",
+    "ongotpointercapture",
+    "onlostpointercapture",
+    "onpointerrawupdate",
+    "onanimationcancel",
+    "onanimationend",
+    "onanimationiteration",
+    "onanimationstart",
+    "ontransitioncancel",
+    "ontransitionend",
+    "ontransitionrun",
+    "ontransitionstart",
+    "onauxclick"
   };
 
   public static String[] uriAttributes = {"href", "src", "action"};

src/test/java/utils/FindXSSTest.java

@@ -51,6 +51,31 @@ void search_detectsOnmouseoverAlert() {
     assertTrue(FindXSS.search("<span onmouseover=\"alert(1)\">hover</span>"));
   }
 
+  @Test
+  void search_detectsOnpointeroverAlert() {
+    assertTrue(FindXSS.search("<div onpointerover=\"alert(1)\">MOVE HERE</div>"));
+  }
+
+  @Test
+  void search_detectsOnpointerenterAlert() {
+    assertTrue(FindXSS.search("<div onpointerenter=\"alert(1)\">hover</div>"));
+  }
+
+  @Test
+  void search_detectsOnanimationstartAlert() {
+    assertTrue(FindXSS.search("<div onanimationstart=\"alert(1)\">animation</div>"));
+  }
+
+  @Test
+  void search_detectsOntransitionendAlert() {
+    assertTrue(FindXSS.search("<div ontransitionend=\"alert(1)\">transition</div>"));
+  }
+
+  @Test
+  void search_detectsOnauxclickAlert() {
+    assertTrue(FindXSS.search("<div onauxclick=\"alert(1)\">click</div>"));
+  }
+
   @Test
   void search_eventWithoutAlertNotDetected() {
     assertFalse(FindXSS.search("<div onclick=\"doSomething()\">click</div>"));