I took a few hours to create a simple HTML/CSS previewer system. Since there's no way to add JavaScript then my server should be safe, right? Grab the flag from the http://chals.swampctf.com:47821/flag.txt file on the server to show that this isn't the case. The flag is in the standard format. Good luck! http://chals.swampctf.com:47821