DOM XSS in jQuery anchor href attribute sink using location.search source