Guest User

Untitled

a guest
Sep 14th, 2019
189
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. const express = require('express');
  2. const app = express()
  3. const port = 3000
  4.  
  5. app.get('/', handleRender)
  6.  
  7. function handleRender(req, res) {
  8.   const html = '<div></div>'
  9.   const preloadedState = JSON.stringify({ input: `</script><script>alert(1)</script>` });
  10.  
  11.   res.send(`
  12.   <!doctype html>
  13.   <html>
  14.     <head>
  15.     <body>
  16.       <div id="root">${html}</div>
  17.       <script>
  18.         window.__PRELOADED_STATE__ = ${preloadedState}
  19.       </script>
  20.     </body>
  21.   </html>
  22.   `);
  23. }
  24.  
  25. app.listen(port)
RAW Paste Data