•  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
더 보기

나는 문법이다(비교)

r30 vs r31
11{{{#!html
22<a href="javascript:alert('XSS')">XSS</a>
33<script>
44 alert('hello');
55</script>
66<meta http-equiv="refresh" content="0; url=https://namu.wiki"></meta>
77<meta http-equiv="refresh" content="0; url=https://namu.wiki"></meta>
88<img src="#" onerror="alert('XSS')">
99<ruby oncopy="alert('XSS')">XSS</ruby>
1010<a href="&#x6A;&#x61;&#x76;&#x61;&#x73;&#xA;&#x63;&#x72;&#x69;&#x70;&#x74;&#xA;&#x3A;&#xA;&#x61;&#x6C;&#x65;&#x72;&#x74;&#xA;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29;">XSS</a>
1111}}}
1212막힌거 확인
1313
14{{{#!syntax javascript
15router.get(/^\/contribution\/(ip|author)\/(.+)\/edit_request$/, async function EditRequestList(req, res) {
16 const ismember = req.params[0];
17 const username = req.params[1];
18 var moredata = [];
19
20var data = await curs.execute("select flags, title, namespace, rev, time, changes, log, iserq, erqnum, advance, ismember, username, loghider from history \
21 where cast(time as integer) >= ? and ismember = ? " + (username.replace(/\s/g, '') ? "and lower(username) = ?" : "and (lower(username) like '%' || ?)") + " order by cast(time as integer) desc", [
22 Number(getTime()) - 2592000000, ismember, username.toLowerCase()
23 ]);
24}}}
25
26{{{#!html
27<h1>와우 친구들! 빡빡이 아저씨야</h1>
28}}}
29
30렌더링 의외로 잘 되는듯
31
32솧툌춋
33[ruby(><script>alert('솧툌춋');<script> <--)]
34