Shell network storage type xss (can still be bypassed after repair)

The connection insertion at the posting area can be filled in with the xss proxy network. This sending box already has an xss problem. Someone mentioned the vulnerability on wooyun and fixed it later, however, the use of & # encoding bypass keyword check is not considered. In the post: As you can see, if href is not filtered in code mode, it is directly output to the tag of the page. After the vulnerability exists, the shell adds a filter here. After "javascript:" is entered, it will be prompted to include sensitive words for review. However, this discovery can be bypassed after using & # encoding, in addition, the browser can trigger js. Below is the proof that the source code seen by the Client: firebug: trigger js after clicking. Here we can get the cookie, but the key value is httponly:
Solution:Decode & # and filter keywords.