HTML Sanitizing Information Disclosure - CVE-2011-1252
Introduction
The JavaScript function toStaticHTML, which is found in Internet Explorer 8 and Internet Explorer 9 is used to sanitize
HTML fragments from dynamic and potentially malicious content.
If an attacker is able to break the filtering mechanism and pass malicious code through this function, he/she may be
able to perform HTML injection based attacks (i.e. XSS).
Vulnerability
An attacker is able to create a specially formed CSS that after passing through the toStaticHTML function will contain
an expression that will trigger a JavaScript call.
The following JavaScript code will demonstrate the vulnerability:
