I've recently gotten into web security and javascript and I think this looks like apretty promising DOM XSS:
let hastagIntentos = 0
, posAnterior = 0
, reintentosHatagPos = 0;
function enlacesParciales() {
if (window.location.hash.length > 0) {
let c = $(window.location.hash);
hastagIntentos++,
0 == c.length ? hastagIntentos < 100 && setTimeout((function() {
enlacesParciales()
}
), 800) : (console.log("encuentro", c.offset().top),
posAnterior != c.offset().top && (posAnterior = c.offset().top,
$([document.documentElement, document.body]).animate({
scrollTop: c.offset().top
}, 800),
reintentosHatagPos < 10 ? (reintentosHatagPos++,
setTimeout((function() {
enlacesParciales()
}
), 1e3)) : reintentosHatagPos = 0))
}
}
And especially this:
let c = $(window.location.hash);
window.location.hash
, what could I do? All I'm seeing is it checking the length and the offset function. Why do you think that line exposes something uniquely problematic?