We have a potential XSS warning on this code:
if (someCondition) {
//location.reload();
window.location = document.URL;
}
The message is:
The application's FunctionName embeds untrusted data in the generated output with location, at line 433 of Directory\CodeFile.js. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
Is there any actual vulnerability here (and if yes, what should we use instead, knowing that location.reload() wasn't satisfying?), or should I simply flag this as Not Exploitable and move on?
URL escape the document.URL before passing the value to window.location
if (someCondition) {
location.href = encodeURIComponent(document.URL);
}