javascript - What XSS attacks could be done with window.location

Question

Which XSS attacks could be done when redirecting with window.location and user input data.

I think this ones

• User can write a post with a title that contains http:// so the end user ends up on a bad site.
• User can write a post with title "javascript:EvilCode()" I think this will be executed in some browsers?

Answer 1

如果您不先对数据进行 URL 编码，您可能会允许XSS 。