Suspected cross-site scripting (XSS) found in subject

type.inbound
// subject contains suspected cross site scripting
and regex.icontains(subject.subject,
                    '(?:[<]|%(25)?3c|\\u003c|\\x3c|&[lg]t;|&n[vw][lg]t;)\/?(?:script(?:\s*/?\s*src\s*=)?|div|iframe|embed|object|style|form|meta|link|svg|img|audio|video|source|body|input|textarea|select|noscript|(?:/|%(25)?2f)?title|(?:/|%(25)?2f)?textarea|(?:/|%(25)?2f)?style|(?:/|%(25)?2f)?template|(?:/|%(25)?2f)?noembed)',
                    // constructor chain pattern
                    'constructor\.constructor|\[\s*constructor\s*\]|\.__proto__|\[constructor\]'
)

// and contains html or url encoded strings, hex escaped strings, opening or closing html tags, or escaped non word characters
// subject contains common event handlers
and regex.icontains(subject.subject,
                    '(?:\b|%[a-f0-9]{2})(?:on(?:abort|blur|change|click|dblclick|error|focus|load|mouse(?:over|out|move|down|up)|key(?:down|up|press)|reset|select|submit|unload)|srcdoc|src\s*(?:=|%(?:25)?3d))',
                    // subject contains javascript funcitons
                    '(?:\b|%(?:25)?[a-f0-9]{2})(?:javascript|eval|settimeout|setinterval|document\.(?:cookie|write|location|createElement|body|appendChild)|fetch|constructor|__proto__|prototype|atob|getScript|script(?:\s|%(?:25)?20)src)(?:\b|%(?:25)?[a-f0-9]{2})',
                    // url encoded forms of script src
                    '(?:\b|%(?:25)?[a-f0-9]{2})script(?:\s|%(?:25)?20)src(?:\b|%(?:25)?[a-f0-9]{2})'
)
and regex.icontains(subject.subject,
                    // Pattern 1: Quote followed by various special characters in encoded/literal forms:
                    // - < > angle brackets (%3C, %3E, literal, &lt;, &gt;)
                    // - quotes (&quot;, &apos;)
                    // - parentheses (&lpar;, &rpar;)
                    // - curly braces (&lcub;, &rcub;)
                    // - square brackets (&lsqb;, &rsqb;)
                    // - equals sign (&equals;)
                    // - forward/backward slashes (&sol;, &bsol;)
                    // - colon (&colon;)
                    // - semicolon (&semi;)
                    '[\x27\x22](?:%3[CE]|[<>]|&(?:lt|gt|quot|apos|[lr](?:par|cub|sqb)|equals|[bs]ol|colon|semi)\x3b)',
                    // Pattern 2: Encoded/special characters followed by quote
                    // Same as above but in reverse order - special chars followed by quote
                    '(?:%3[CE]|[<>]|&(?:lt|gt|quot|apos|[lr](?:par|cub|sqb)|equals|[bs]ol|colon|semi)\x3b)[\x27\x22]',

                    // Pattern 3: Hexadecimal or decimal HTML entities with semicolon
                    // e.g., &#x27; (hex) or &#39; (decimal)
                    '&#[xX]?[a-f0-9]+;',

                    // Pattern 4: Raw decimal HTML entities
                    // e.g., &#60 (without semicolon)
                    '&#\d+',

                    // Pattern 5: URL encoded characters
                    // e.g., %3C for <, %3E for >, %22 for ", %27 for '
                    '%[a-f0-9]{2}',

                    // Pattern 6: Unicode/hex escapes
                    // e.g., \u003C for <, \x3C for
                    '\\[xXuU][a-f0-9]{4}',
                    // New patterns for this type of payload
                    '</[^>]+/[^>]+>', // Matches closing tags with slash delimiters
                    '//[^"\x27>\s]+', // Matches protocol-relative URLs
                    'xss\.report', // Specific known XSS domains
                    '/\*|\*/|\-\->', // comment chars (/*, */, -->)
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
      or (
        strings.icontains(sender.display_name, "via")
        and any(headers.hops,
                any(.fields,
                    .name == "List-ID"
                    and strings.ends_with(.value,
                                          strings.concat(sender.email.domain.domain,
                                                         ">"
                                          )
                    )
                )
        )
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)