Is there a way to test the exploit without popping up an alert?

[DinisCruz]

That should make the tests more solid, since as I'm reading it, the way to check if jPurify is working is to run it and confirm that no popup test is running (right?)

Are there tests that show those sinks actually triggering the javascript execution?

[cure53]

Not sure if I understand the question 100% right. What exactly do you mean?

[DinisCruz]

At the moment it looks like the tests are designed to show that the popup does not happen

 $('#append').append('<li>#append XSS from HTML string</li><iframe/onload=alert(2.1)>', '<iframe/onload=alert(2.2)>');

right?

[cure53]

Yep, exactly. You want it the other way round, correct?

[DinisCruz]

for the cases where it is exploitable, yes we should be testing that the alert was called

[cure53]

So, what is needed from our side?

[DinisCruz]

@cure53 check this test out

https://github.com/OWASP/Maturity-Models/issues/153#issuecomment-234985203

a 'jquery variation of that' should work here right?