Sina mail message body XSS-Rich Text Filtering Policy Bypass

After research, it is found that a defect of the rich text filter can successfully bypass the XSS and kill all browsers.
1. Do some basic tests first. --> filter --> do not filter --> it is not a simple keyword. 2. This should not be filtered. 3. Try to use the priority resolution of the <title> </title> tag pair. <Title> This helps beginners understand the concept. The filter is parsed. The browser will first parse the title 4. You can see that the code is successfully executed under IE! 5. then we call xsser. me code. <title> "> you can see the code parsed by the browser after the email is opened. In xsser. me, the code is successfully executed.
 Solution:
It is unclear how the background filter code works. 1. <title> this type of TAG should not be frequently used in emails. Can it be filtered out directly? 2. or, if the filter is not directly filtered out, the <title> .. </title> <textarea> .. </textarea> If a tag with priority resolution is obtained first, and then the remaining content is replaced? = You have to think about it yourself. I am stupid.