DOMXSS in redirect param

#Summary The **redirect** param can consist of a ``blocked:`` url, which results in XSS. If a victim visits a malicious URL and logs in, the attacker can perform actions on behalf of the victim. #Steps to reproduce 1) Logout 2) Visit `` https://lgtm-com.pentesting.semmle.net/?redirect=blocked:prompt(document.domain)%2f%2f `` 3) Log in through email ## Impact If a victim visits a malicious URL and logs in, the attacker can perform actions on behalf of the victim.