codeql/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tainted-url-suffix-arguments.js

import 'dummy';

function foo(x, y, z) {
    arguments; // ensure 'arguments' are used
    document.writeln(x);
    document.writeln(y); // $ Alert
    document.writeln(z);
}

function bar() {
    const url = window.location.href; // $ Source
    foo('safe', url, 'safe');
}