Here is the "writeup". Hope its clear enough, otherwise ask in comments. Note that there are two paths that will result in XSS. And that the "error path" can be reached in numerous different ways, like alternative 1 and 4.
Alternative 5 hits the "successful path" and can also be used in many ways
add a skeleton here at some point
11 months ago