What's in a tag name? JavaScript, apparently

A user explored web browser limitations regarding HTML tag naming conventions and event handling to discover methods for bypassing security controls. The exploration began by investigating the behavior of the `localName` property, which revealed a lowercase version of the tag name, suggesting potential avenues for using uppercase JavaScript. Subsequent experimentation involved manipulating tag names with characters like slashes, whitespace, and newlines, noting that line and paragraph separators were treated differently from standard JavaScript newlines. The user discovered that by leveraging specific HTML attributes, such as `part`, they could manipulate event objects to execute code via the `onfocus` event handler. Further testing revealed methods to use elements like `contenteditable` for focusability and to utilize functions like `getAttributeNode` and `setHTMLUnsafe` to achieve further manipulation of the DOM. The findings indicate that seemingly innocuous HTML properties can be exploited to introduce JavaScript payloads or markup, potentially bypassing Web Application Firewalls (WAFs).

The narrative demonstrates a progression from a simple inquiry about technical constraints to advanced exploitation techniques, suggesting that vulnerabilities are often latent within seemingly benign features of browser implementations. The core implication is that the separation between intended structural representation (HTML) and executable logic (JavaScript) is porous, especially when specific properties like `localName`, `part`, and `classList` are examined closely. The transition from discovering a lowercase tag name to chaining events and leveraging object constructors highlights a pattern where minor deviations in parsing rules can be weaponized. This process echoes the principle that system boundaries—like character encoding or event handling—are not absolute barriers but rather systems of negotiable rules. The existence of methods like `setHTMLUnsafe` and undocumented behaviors in property inspection suggests a persistent gap between documented security expectations and actual browser behavior, which malicious actors can exploit for bypass. The lesson here is less about the specific characters and more about establishing cognitive sovereignty by recognizing that default assumptions about web security are often artifacts of convenience rather than fundamental constraints. What unseen rules govern other seemingly harmless properties in complex systems, and how do we build defenses against emergent behaviors rather than static blocklists?