DOM XSS in document.write sink using source location.search