title: OWASP ESAPI XSS Attack undetected
body: <p>In a web project we use ESAPI validator to detect XSS attacks using antisamy XML file. While most of the attacks are detected as expected, it fails to detect the below given input as an XSS attack.</p>
  <p><strong>&lt;img src=x onerror=alert(1) alt=</strong></p>
  <p>Potentially, the browser closes the  tag itself, hence triggering the alert function.</p>
  <p>Surprisingly, ESAPI detects the below given input as an XSS attack:</p>
  <p><strong>&lt;img src=x onerror=alert(1) alt=&quot;text&quot;</strong></p>
  <p>The backend has been written in Java and the UI in JavaScript.
  Antisamy file used:</p>
  <p><a href="https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/antisamy-esapi.xml" rel="nofollow noreferrer">https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/antisamy-esapi.xml</a></p>
  <p>I also tried using the myspace antisamy file, but the problem still persists.</p>
  <p>Can someone please help me with the reason for the difference in behavior or how to mitigate the problem?</p>
  <p>Thanks.</p>