Coin
says to
YSITD
https://owasp.org/www-community/attacks/DOM_Based_XSS