Fuzz if window.location.href = `/${user_input}`; can redirect to javascript pseudo protocol.
const url = new URL(`/${String.fromCodePoint($[i])}javascript:alert(origin)`);0x0D if (url.protocol === 'javascript:') {0x0D log($[i]);0x0D }