title: Javascript executing on copy paste in iframe
body: <p>I have built an inframe editor from scratch. I am trying it for XSS vulnerability. The iframe is described as:</p>
  
  <pre><code>&lt;iframe   id="wysiwygtextfield" onload="return initialize(this);"  frameborder="0"  scrolling="no" &gt;
                   &lt;html&gt;
                        &lt;head&gt;
                        &lt;/head&gt;
                   &lt;body spellcheck = "true"&gt;
                        &lt;br/&gt;
                   &lt;/body&gt;
                   &lt;/html&gt;
  &lt;iframe&gt;
  </code></pre>
  
  <p>I try copy pasting the following vector:</p>
  
  <pre><code>&lt;SCRIPT SRC=//ha.ckers.org/.j&gt;
  </code></pre>
  
  <p>And it executes. I have a event trigger on the copy paste event which is like this:</p>
  
  <pre><code>    $('#wysiwygtextfield').contents().find('body').bind("paste", function(e) {
  
          var element = this;
           setTimeout(function(){
          var text = $(element).text() ;
        /*  var pattern = /&lt;script(\s+(\w+\s*=\s*("|').*?\3)\s*)*\s*(\/&gt;|&gt;.*?&lt;\/script\s*&gt;)/;
  
          text = text.toLowerCase().replace(pattern,"Dirty paste") ; */
      $('#wysiwygtextfield').contents().find('img').each(
                                                      function()
                                 { text += "&lt;br/&gt;&lt;br/&gt;"+ $(this).get(0).outerHTML ; }
  );
  
          $(element).html(text) ; },10);
  
      }); 
  </code></pre>
  
  <p>I tried using a regular expression match to counter it, but it is not effective (more of a black list). I tried some of the other text editors out there (ckeditor and tinymce) and they simply copy paste the text without the javascript getting executed. Is there any other way to safely copy paste the javascript without executing? I have a sanitizer on the server side to remove the markup. </p>