Random seed may result in valid attribute

[gbrindisi]

The randoms generated seed for the taint may result as a valid html attribute like href, src, etc.

https://github.com/gbrindisi/xsssniper/blob/master/core/payload.py#L14

Must blacklist common attributes names.

[fgeek]

Wouldn't it be better just to use long enough randoms so that it won't overlap with anything existing?

[gbrindisi]

Yes but since I've left the chance to set the seed length to the user, this problem could still occur. If you have better ideas I'd like to hear them!