我在输入〈img src=a onerror=alert（'xss！'）〉时遇到了一个关于标记域组件的问题。这个标记在输入整个值后执行。我已经尝试过在keyup、keypress、keydown和beforquery事件上阻止标记执行，但它仍然在执行。这个代码块在检测到XSS标记时阻止事件执行。

Ext.application({
    name: 'Fiddle',

    launch: function () {

        var shows = Ext.create('Ext.data.Store', {
            fields: ['id', 'show'],
            data: []
        });

        Ext.create('Ext.form.Panel', {
            renderTo: Ext.getBody(),
            title: 'Sci-Fi Television',
            height: 200,
            width: 500,
            items: [{
                xtype: 'tagfield',
                itemId: 'tagField',
                fieldLabel: 'Select a Show',
                store: shows,
                displayField: 'show',
                valueField: 'id',
                queryMode: 'local',
                filterPickList: false,
                listeners: {
                    beforequery: function () {
                        var editor = Ext.ComponentQuery.query('#tagField')[0];
                        if (editor.inputEl.getValue().search(new RegExp('(<([^>]+)>)')) >= 0) {
                            editor.inputEl.dom.value = '';
                            return false;
                        }
                    },
                    keypress: function (textfield, event) {
                        var editor = Ext.ComponentQuery.query('#tagField')[0];
                        if (editor.inputEl.getValue().search(new RegExp('(<([^>]+)>)')) >= 0) {
                            editor.inputEl.dom.value = '';
                            return false;
                        }
                    },
                    keydown: function (textfield, event) {
                        var editor = Ext.ComponentQuery.query('#tagField')[0];
                        if (editor.inputEl.getValue().search(new RegExp('(<([^>]+)>)')) >= 0) {
                            editor.inputEl.dom.value = '';
                            return false;
                        }
                    },
                }
            }]
        });

    }
});

enter image description here