My question is, what other ways are there for these kinds of vulnerabilities to be introduced into a web page without accessing
window.location or just plain
location)? In other words, if a page does not ever access
document.location, is it definitely free from these vulnerabilities? If not (and I'm sure it's not), could you please provide some other examples of vulnerable code?