http://mat.i2p/internet-roadtrip-pathfinder
For strings that match the Regex, it interpolates them as such: <img src="https://cdn. discordapp. com/ emojis/{id}.{png or gif}" alt="{name}" class="discord- emoji /"> . Finally, it goes through DOMPurify to only allow img tags with the attributes above. This was a good call on Neal’s part, since it significantly limits the scope of the bug.