> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/crsf/lab-7.md).
# Lab 7
```
redirectOnConfirmation = (blogPath) => {
setTimeout(() => {
const url = new URL(window.location);
const postId = url.searchParams.get("postId");
window.location = blogPath + '/' + postId;
},
3000);
}
```
* `redirectOnConfirmation = (blogPath) => {`: This defines a function that takes one argument, `blogPath` (which the site usually sets to `/post`).
* `setTimeout(() => { ... }, 3000);`: This tells the browser: "Wait 3 seconds (3000 milliseconds), then run the code inside these brackets." This explains why you see the confirmation page briefly before being moved.
* `const url = new URL(window.location);`: This grabs the current URL of the page you are on (the confirmation page).
* `const postId = url.searchParams.get("postId");`: This is the vulnerable part. It looks at the URL, finds the `postId` parameter, and saves whatever value is there into a variable.
* *Example:* If the URL is `.../confirmation?postId=6`, then `postId` becomes `6`.
* `window.location = blogPath + '/' + postId;`: This is the sink (the action). It tells the browser to navigate to a new page by stitching the strings together.
* *Normal behavior:* It sends you to `/post/6`
It works - gadjet is send:
```
```