So for example #1:

    'data'       : '<form id="test"></form><button form="test" formaction="%js_uri_alert%">X</button>',

Would now have:

    'data'       : '<form id="test"></form><button form="test" formaction="%js_uri_alert%">X</button>',
    'trigger'    : 'document.getElementsByTagName("button")[0].click()'

So if we wanted to automate verification of this exploits and on what browsers it's exploitable, it would be easy.

Also, it would be useful to remove the comments: /* ID 1 - XSS via formaction - requiring user interaction (1) */

As they are redundant, and force us to manually edit the JSON file (eg, if it's modified, it can't be trivially automatically generated, but that's not such an important feature.

Closed by #8