cocuh · December 22, 2013 16:40
diff --git a/script.js b/script.js
 window.onload = function(){
    console.log('external javascript:'+document.domain);
    document.getElementById("elem_ex").onclick=function(){
        console.log('external javascript onclick:'+document.domain)
    };
 };
diff --git a/xss.css b/xss.css
 .xss{
    fill:blue;
    stroke:red;
    stroke-width:expression(console.log("css expression:"+document.domain));
 }
diff --git a/xss.svg b/xss.svg
	window.onload = function(){
	console.log('external javascript:'+document.domain);
	document.getElementById("elem_ex").onclick=function(){
	console.log('external javascript onclick:'+document.domain)
	};
	};
	.xss{
	fill:blue;
	stroke:red;
	stroke-width:expression(console.log("css expression:"+document.domain));
	}