== How to fix it in DOM API

=== Code examples

include::../../common/fix/code-rationale.adoc[]

==== Noncompliant code example

The following example is vulnerable to open redirection through the following URL: `\https://example.com/redirect?url=https://evil.com`;

[source,javascript,diff-id=1,diff-type=noncompliant]
----
const queryParams = new URLSearchParams(document.location.search); 
const redirectUrl = queryParams.get("url");
document.location = redirectUrl; // Noncompliant
----

==== Compliant solution

[source,javascript,diff-id=1,diff-type=compliant]
----
const queryParams = new URLSearchParams(document.location.search); 
const redirectUrl = queryParams.get("url");

if (redirectUrl.startsWith("https://www.example.com/")) { 
    document.location = redirectUrl;
}
----

include::../../common/fix/how-does-this-work.adoc[]

=== Pitfalls

include::../../common/pitfalls/starts-with.adoc[]