xss JS @ /tdfw.js