https://martinotommasini.github.io/posts/Reflected-XSS-on-custom-tag/