•  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
더 보기

나는 문법이다(비교)

r15 vs r16
11{{{#!html
22<a href="javascript:alert('XSS')">XSS</a>
33<script>
44 alert('hello');
55</script>
66<meta http-equiv="refresh" content="0; url=https://namu.wiki"></meta>
77<meta http-equiv="refresh" content="0; url=https://namu.wiki"></meta>
88<img src="#" onerror="alert('XSS')">
99<ruby oncopy="alert('XSS')">XSS</ruby>
1010<a href="&#x6A;&#x61;&#x76;&#x61;&#x73;&#xA;&#x63;&#x72;&#x69;&#x70;&#x74;&#xA;&#x3A;&#xA;&#x61;&#x6C;&#x65;&#x72;&#x74;&#xA;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29;">XSS</a>
1111}}}
1212막힌거 확인
1313
1414{{{#!syntax javascript
1515router.get(/^\/contribution\/(ip|author)\/(.+)\/edit_request$/, async function EditRequestList(req, res) {
1616 const ismember = req.params[0];
1717 const username = req.params[1];
1818 var moredata = [];
1919
2020var data = await curs.execute("select flags, title, namespace, rev, time, changes, log, iserq, erqnum, advance, ismember, username, loghider from history \
2121 where cast(time as integer) >= ? and ismember = ? " + (username.replace(/\s/g, '') ? "and lower(username) = ?" : "and (lower(username) like '%' || ?)") + " order by cast(time as integer) desc", [
2222 Number(getTime()) - 2592000000, ismember, username.toLowerCase()
2323 ]);
2424}}}
2525
2626{{{#!html
2727<h1>와우 친구들! 빡빡이 아저씨야</h1>
2828}}}
2929
3030렌더링 의외로 잘 되는듯
3131