An XSS bug was found in United Airlines by Strukt and Burelogic (full article here). Apparently they were using this to protect from XSS:
Basically, the code overrides the native
document.write()functions and nullifies them, so calling them does absolutely nothing. This was implemented as an "XSS protection".
I was wondering if using a base tag to point to a js file with a simple XSS payload would be blocked by the same function that blocked the XSS in the first place.