Original before eval-2

<p id="eval-2">Original before eval-2</p>

new Function(`document.getElementById('eval-2').textContent='[!] Changed from external using new Function()'`)();

Secrets?

<p id='style-self-external-2'>Secrets?</p>
<input type='PassWord' name='password' value='love4ever' />

Should be fancy font if @import works in css for google fonts

<p class="google-font-too">
 Should be fancy font if @import works in css for google fonts
</p>

<iframe id='iframe-remote-youtube' width='400' height='225' src='https://www.youtube.com/embed/s4wrMMju-Xc?enablejsapi=1&debugjs=1&debugcss=1' 
frameborder='0' allow='accelerometer;autoplay;encrypted-media;gyroscope;picture-in-picture' allowfullscreen></iframe>

<iframe src='https://player.vimeo.com/video/1084537' width='400' height='225' frameborder='0' webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>

Will change if xss triggers

<iframe border='0' src='xss.php' width='400' height='225'></iframe>
<p id='iframe-local'>Will change if xss triggers</p>

Will change once AJAX is done

<p id='ajax-local'>Will change once AJAX is done</p>

fetch('ajax.php')
    .then(function(response) {
        return response.json();
    })
    .then(function(d) {
        var el = document.querySelector('#ajax-local');
        el.textContent = d.msg;
    })
    .catch(function(err) {
        var el = document.querySelector('#ajax-local');
        if (!el) {return;}
        el.textContent = err;
    });

<script src="https://checkout.stripe.com/checkout.js"></script>
<button id="stripe-button">Stripe</button>

var handler = StripeCheckout.configure({
    key: 'pk_KBCS2K6UgQc8K9VZCtNMOK4AEl5aU'
    // Ignore me
});
var btn = document.getElementById('stripe-button');
btn.addEventListener('click', function(e) {
    var x = handler.open({
      name: 'Demo Site',
      description: '2 widgets',
      amount: 10,
      opened: function() { btn.classList.add('opened'); },
    });
    e.preventDefault();
});

window.addEventListener('popstate', function() {
    handler.close();
});

btn.click();
setTimeout(function() {
  var el = document.querySelector('[name=stripe_checkout_app]');
  if (!el) {return;}
  el.style.display='none';
}, 5000);

<embed src="static/smashing-the-stack.pdf" type="application/pdf" width="400" height="225">
</embed>

<embed src="static/jquery.svg" type="image/svg+xml" width="400" height="225">
</embed>

Waiting for worker ...

<p id='worker-1'>Waiting for worker ...</p>

(function(){
  if (!window.Worker) { return;}
  const worker = new Worker('/static/worker.js');
  worker.onerror = function(e) {};
  worker.onmessage = function(e) {
    var el = document.getElementById('worker-1');
    el.textContent = 'Result from worker - ' + e.data;
  };
  setTimeout(() => worker.postMessage([2, 2]), 1000);
})();