What I understand about reflected XSS is
... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1]
Assuming that my webapp has a CSRF validation on server that checks for a valid CSRF token for all requests. It will give proper error if it receives any request not containing CSRF token (this error is a simple string, it has no attack vectors). For the sake of completeness, let's also say that I have proper security measures for preventing CSRF token from being stolen or guessed.
So is it safe to assume that CSRF tokens also prevent reflected XSS attack because both of these are true:
- The server doesn't reflect anything if CSRF token is not present.
- The attacker cannot have or guess CSRF token.