Fix #545: Add support for HTML5 pointer and transition event handlers

[jeffrey-theog06]

Description

This PR fixes an issue where successful XSS attacks using modern HTML5 event handlers (such as onpointerover, onpointerenter, etc.) were not recognized by the Security Shepherd backend, preventing players from being awarded challenge completion.

Root Cause

In XSS challenges where standard event handlers (like onclick or onerror) are filtered, players bypass these filters using alternative event handlers. However, the backend validation helper FindXSS.java validates if XSS was successful by searching the sanitized input for specific event handlers defined in a hardcoded list javascriptTriggers. Because pointer, animation, and transition events were missing from this list, the server did not detect the successful exploitation.

Changes

1. FindXSS.java: Added the following event handlers to the javascriptTriggers array:
   • Pointer Events: onpointerdown, onpointerup, onpointercancel, onpointermove, onpointerover, onpointerout, onpointerenter, onpointerleave, ongotpointercapture, onlostpointercapture, onpointerrawupdate
   • Animation Events: onanimationcancel, onanimationend, onanimationiteration, onanimationstart
   • Transition Events: ontransitioncancel, ontransitionend, ontransitionrun, ontransitionstart
   • Other: onauxclick
2. FindXSSTest.java: Added unit tests (search_detectsOnpointeroverAlert, search_detectsOnpointerenterAlert) to verify that the pointer events successfully trigger XSS detection.

Closes #545