I found a reflected XSS in an application during a test, where I define the string passed to:
Some input sanitisation occurs, for instance my string is only recorded after the first
/. So I've managed to escape the document.location command by URL encoding
/'//\nalert(1), which runs the
alert(1), but immediately redirects me to the root
/ of the webapp.
Is there anything I can do to prevent the change of the document location?
edit: With the above mentioned user input, the code looks as follows: