title: Is it secure to use window.location.href directly without validation
body: <p>Is it secure to use window.location.href without any validation?</p>
  
  <p>For example:</p>
  
  <pre><code>&lt;script&gt;
      var value = window.location.href;
      alert(value);
  &lt;/script&gt;
  </code></pre>
  
  <p>From the above example, is it vulnerable to Cross-site scripting (XSS) attack?
  If it is, then how? How the attacker can modify the value of window.location.href to the malicious content?</p>
  
  <p><strong>Edit (Second Situation)</strong></p>
  
  <p>This is the url : www.example.com?url=www.attack.com</p>
  
  <p>Just assume taht I have a getQueryString() function that will return value without validation.</p>
  
  <pre><code>&lt;script&gt; 
      var value = getQueryString('url'); 
      window.location.href = value; 
  &lt;/script&gt;
  </code></pre>
  
  <p>Same question, is it vulnerable to Cross-site scripting (XSS) attack?
  If it is, then how? How can an attacker just make use of "window.location.href = value" to perform XSS?</p>