Crawl Field Notes

Inert context canary classified

The fixed html-entity case was classified.

The values below are server-defined identifiers. They are shown only in text nodes and are never inserted into a live HTML, URL, style, event, or script sink.

Shape label
script-element
Context label
html-text
Transformation label
entity-roundtrip
Source canary
CANARY%3AHTML_TEXT%3A01
Normalized canary
CANARY:HTML_TEXT:01
Serialized canary
CANARY:HTML_TEXT:01

Open the same-origin inert sandbox host

Measurement marker: ARN-BOUNDARY-XSS-CONTEXT-HTML-ENTITY-CLASSIFIED