Marduk_James 
A lot of XSS write-ups focus on HTML injection (innerHTML, document.write, etc).
But navigation-based sinks are just as dangerous.
If user input reaches location.href, a javascript: URI can turn a redirect into code execution in the page’s context.
I put together a practical breakdown with examples and real-world patterns:
https://medium.com/@marduk.i.am/why-location-href-isnt-just-a-redirect-f7c77c0e4bcd
