https://systw.net/note/archives/1255
DOM XSS with reflected and store