xss bypassing angle brackets and double quotes escaping

Question

Say I want to maliciously call a function which is already defined, myfunc().

How could I achieve xss attack bypassing double quote and angle brackets escaping?

<h2>Profile of INPUTNAME</h2><p>INPUT2</p><a href="INPUTURL">Homepage</a>

(The upper case fields are user inputs) How could I call myfunc() without adding the script tags around it?

Solution

(Un)fortunately it appears that XSS won't be possible in this instance.

If angle brackets and double quote characters are escaped, this is enough to prevent XSS in HTML body and double quoted entity value contexts.

Technically under the XSS Experimental Minimal Encoding Rules for HTML body, the & character should be encoded too, but I can't see a way here to use that to the attacker's advantage either in the HTML body or within the entity value.

The only exception to this is if the character set was specified as UTF-7 (or as the attacker you could change it to such) then you could use the following attack:

INPUTNAME = +ADw-script+AD4-myfunc()+ADw-/script+AD4-

this would be rendered as

<h2>Profile of <script>myfunc()</script></h2><p>INPUT2</p><a href="http://example.com">Homepage</a>