> Note: This article is only for personal learning, technical research, and process recording. It is strictly forbidden to use this content for unauthorized testing, attacking, bypassing platform rules, scraping data, or any other actions that might harm the platform, its users, or the fairness of the competition. ## Environment Setup | Category | Configuration / Details | | --- | --- | | Operating System | Windows 11 | | Browser | Google Chrome v145.0.7632.26 | | Server OS (if any) | Ubuntu 22.04 LTS | | Python Environment (if any) | Python 3.12 | NHD (National History Day) is a famous global history competition. One way to participate is by making a website. However, starting in 2025, NHD only allows students to use their official tool, [NHDWebCentral®](https://website.nhd.org/). Even though the editor lets you upload your own code, it actively deletes all JavaScript and changes some of your CSS. The site also has strict CSP (Content Security Policy) and file sandbox rules. This post is mainly to record how I got around these limits to successfully run JavaScript and connect to the internet. ## Bypassing the JavaScript Ban and Inline Injection First, let's try to run some JavaScript. Both the front-end and back-end of the NHD editor block JS and inline code injection. Here is the filtering code pulled directly from the editor: ```javascript Clean: (value) => { if (value && value.length > 0) { var response = []; var start = 0; for (var i = 0; i < value.length - 1; i++) { var char = value[i]; var char2 = value[i + 1]; if (char == '<' && char2 == '?') { if (i - start > 0) response.push(value.substring(start, i)); for (var j = i + 2; j < value.length; j++) { var end1 = value[j]; var end2 = value[j + 1]; i = j; start = j + 2; if (end1 == '?' && end2 == '>') { break; } } continue; } if (char == '<' && char2 == '%') { if (i - start > 0) response.push(value.substring(start, i)); for (var j = i + 2; j < value.length; j++) { var end1 = value[j]; var end2 = value[j + 1]; i = j; start = j + 2; if (end1 == '%' && end2 == '>') { break; } } continue; } if (value[i] == '<' && value[i + 1] == '!' && value[i + 2] == '-' && value[i + 3] == '-') { if (i - start > 0) response.push(value.substring(start, i)); for (var j = i + 3; j < value.length; j++) { i = j; start = j + 3; if (value[j] == '-' && value[j + 1] == '-' && value[j + 2] == '>') { break; } } continue; } if (i + 7 < value.length && value.substring(i, i + 7).toLowerCase() == ' 0) response.push(value.substring(start, i)); for (var j = i + 7; j < value.length; j++) { i = j; start = j + 9; if (j + 9 < value.length && value.substring(j, j + 9).toLowerCase() == '') { break; } } continue; } } response.push(value.substring(start)); //console.log(response); return response.join(''); } return value; } ``` The NHD Builder completely stops you from running standard JavaScript directly (it blocks all `

Blog

Arcaea iOS 逆向工程

Welcome

NHD Website Builder Bypassing