I have this vulnerable code which takes a GET parameter, and puts it inside a HTML element (
h1) as well as inside a HTML attribute (
$data = $_GET["payload"]; echo "<h1>" .$data. "</h1>"; echo '<div data-role="button" data-text="' .$data.'"></div>';
The Chrome XSS auditor will block
<script>alert(1)</script> in the first echo (inside the element), but not in the second (inside the attribute) even though the payload could be executed through a script gadget.
Why is that?