3 ms·I smell a potential DOM injection XSS here.by est 17y agoI smell a potential DOM injection XSS here.jauco 17y agoHow? The only reaon this works is that 'this' in a function that is not called on an object will default to the global object (window for browser js). So just saying 'this' in an arbitrary function has the same effect.gcb 17y agobut `this` is filtered by most js clean up libs.