Dalun says to YSITD 但他給的扣跟 https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.javascript_hijacking 基本上一樣