Hi 😃

you can try it out in link the payload i used is (“script” “alert(document.domain)") the payload is taken from the input param and is assigned to input the first check is the switch case statement which check and assigns types,val is append it to tokens [ { "type": "paren", "val": "(" }, { "type": "string", "val": "script" }, { "type": "string", "val": "alert(document.domain)" }, { "type": "paren", "val": ")" } ] so the above object is the tokens object from the payload and the next filter check for the tags (‘h1’, ‘h2’, ‘h3’, ‘div’, ‘ul’, ‘ol’, ‘li’, ‘b’, ‘strong’, ‘em’, ‘br’, ‘p’) and...