In the end, I had to add "tainting" for all DOMParser elements. Any tainted element couldn't be inserted into the DOM. All of those escapes were quite bad, but not catastrophic, given that JS would only run when clicked on the malicious user tile.
СюжетПовреждение нефтепровода «Дружба»，详情可参考PDF资料
。业内人士推荐safew官方下载作为进阶阅读
Названа исполнительница роли Наташи Ростовой в «Войне и мире» Андреасяна14:45
change in any bit of input should flip roughly half of the bits of the。业内人士推荐咪咕体育直播在线免费看作为进阶阅读
Что думаешь? Оцени!