<meta charset="utf-8">
<script type="text/javascript">
    var MutationObserver = window.MutationObserver || window.WebKitMutationObserver || window.MozMutationObserver;
    var observer = new MutationObserver(function(mutations) {
        mutations.forEach(function(mutation) {
            var nodes = mutation.addedNodes;
            for (var i = 0; i < nodes.length; i++) {
                var node = nodes[i];

                if (/xss/.test(node.src) || /xss/.test(node.innerHTML)) {
                    node.parentNode.removeChild(node);
                    console.log('拦截可疑静态模块:', node);
                    //console.log(/xss/.test(node.src) + node.src+'|'+  /xss/.test(node.innerHTML))
                }
            }
        });
    });

    observer.observe(document, {
        subtree: true,
        childList: true
    });
</script>
<script>alert('xss')</script>
<button id="btn">动态添加脚本</button>

<script type="text/javascript">
    btn.onclick=function(){
        var el=document.createElement('script')
        el.src='a.js'
        document.body.appendChild(el)
    }
</script>