Reflected Xss In A Javascript Url With Some Characters Blocked | Portswigger