tl;dr

• meta redirect to attacker website, using the html injection in the paaad.
• leak the unique subdomain with csp violation.
• Another meta redirect csrf with the leaked subdomain to make the note public.