title: HP Fortify issue, possible XSS vulerability?
body: <p>I am trying to understand what risk Fortify is seeing here. I am new to XSS work and I want to be sure before I decide this isn't a real issue. I can't see how a person could use this code for anything but messing up their own computer, so I am curious if I am missing something. </p>
  
  <p>Here is the source text
  Fortify says that the line where <code>window.location.href</code> is being assigned is the vulnerability. "Unvalidated" data sent to browser. </p>
  
  <pre><code>    &lt;c:if test="${isExternalUser}"&gt;
          &lt;script type="text/javascript"&gt;
              $(function(){
                  $('#logoutLink').on('click', function(){
                      var logoutUrl = window.appSettings.context + '/external/logout/';
                      $.get(logoutUrl).done(function(){
                          window.location.href = window.location.protocol + "//" + window.location.host + window.appSettings.context + "/?${ssw:encodeJS(header['policy-signout'])}";                 
                      });
                  });
              });
          &lt;/script&gt;
      &lt;/c:if&gt;
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/iWc8F.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/iWc8F.png" alt="Screenshot from Fortify"></a></p>
  
  <p>As far as I can tell there is no risk here.</p>