Query: cross_site_scripting_attribute_injection

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  (
    request_uri is not null
    and (
      -- Attribute injection patterns
      request_uri ilike '%onerror=%'
      or request_uri ilike '%onload=%'
      or request_uri ilike '%onmouseover=%'
      or request_uri ilike '%onmouseout=%'
      or request_uri ilike '%onclick=%'
      or request_uri ilike '%onfocus=%'
      or request_uri ilike '%onblur=%'
      or request_uri ilike '%onchange=%'
      or request_uri ilike '%onsubmit=%'
      or request_uri ilike '%onkeypress=%'
      -- Less common event handlers
      or request_uri ilike '%onreadystatechange=%'
      or request_uri ilike '%onbeforeonload=%'
      or request_uri ilike '%onanimationstart=%'
      -- Dangerous attributes
      or request_uri ilike '%formaction=%'
      or request_uri ilike '%xlink:href=%'
      or request_uri ilike '%data:text/html%'
      or request_uri ilike '%pattern=%'
    )
  )
  OR
  (
    http_user_agent is not null
    and (
      -- Attribute injection patterns
      http_user_agent ilike '%onerror=%'
      or http_user_agent ilike '%onload=%'
      or http_user_agent ilike '%onmouseover=%'
      or http_user_agent ilike '%onmouseout=%'
      or http_user_agent ilike '%onclick=%'
      or http_user_agent ilike '%onfocus=%'
      or http_user_agent ilike '%onblur=%'
      or http_user_agent ilike '%onchange=%'
      or http_user_agent ilike '%onsubmit=%'
      or http_user_agent ilike '%onkeypress=%'
      -- Less common event handlers
      or http_user_agent ilike '%onreadystatechange=%'
      or http_user_agent ilike '%onbeforeonload=%'
      or http_user_agent ilike '%onanimationstart=%'
      -- Dangerous attributes
      or http_user_agent ilike '%formaction=%'
      or http_user_agent ilike '%xlink:href=%'
      or http_user_agent ilike '%data:text/html%'
      or http_user_agent ilike '%pattern=%'
    )
  )
order by
  tp_timestamp desc;