R research.securitum.com DOMPurify bypass: XSS via HTML namespace confusion 161 points fanf2 6 years ago 81 comments