나는 문법이다(r22 RAW)

{{{#!html
<a href="javascript:alert('XSS')">XSS</a>
<script>
       alert('hello');
</script>
<meta http-equiv="refresh" content="0; url=https://namu.wiki"></meta>
<meta http-equiv="refresh" content="0; url=https://namu.wiki"></meta>
<img src="#" onerror="alert('XSS')">
<ruby oncopy="alert('XSS')">XSS</ruby>
<a href="&#x6A;&#x61;&#x76;&#x61;&#x73;&#xA;&#x63;&#x72;&#x69;&#x70;&#x74;&#xA;&#x3A;&#xA;&#x61;&#x6C;&#x65;&#x72;&#x74;&#xA;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29;">XSS</a>
}}}
막힌거 확인

{{{#!syntax javascript
router.get(/^\/contribution\/(ip|author)\/(.+)\/edit_request$/, async function EditRequestList(req, res) {
        const ismember = req.params[0];
        const username = req.params[1];
        var moredata = [];

var data = await curs.execute("select flags, title, namespace, rev, time, changes, log, iserq, erqnum, advance, ismember, username, loghider from history \
                                where cast(time as integer) >= ? and ismember = ? " + (username.replace(/\s/g, '') ? "and lower(username) = ?" : "and (lower(username) like '%' || ?)") + " order by cast(time as integer) desc", [
                                        Number(getTime()) - 2592000000, ismember, username.toLowerCase()
                                ]);
}}}


렌더링 의외로 잘 되는듯

솧툌춋
[ruby(><script>alert('솧툌춋');<script> <--)]