Csp

A length-restricted XSS behind a brutal CSP. Multiline JS comments stitched several short injections into one script, which poisoned the admin bot notes, navigated it to where the …