URL CONTEXT / ANCHOR TARGET
Anchor link
A fragment becomes an anchor destination. The browser treats a javascript: URL as code when the link is clicked.
// live demo
Where does this link go?
The destination below is filled from the URL fragment.
follow destination →// try this payload
#javascript:alert('anchor')
show the answer
Test URL: append #javascript:alert('anchor') to this page, then click “follow destination”.
Why it works: the fragment is copied into href without checking its scheme. A javascript: URL executes in the page's origin when navigated to.
Fix: prefer fixed relative links. If a destination must be user-controlled, parse it with URL and allow only https: or expected relative URLs.
show the vulnerable line
preview.href = location.hash.slice(1);