JSFiddle - React, Tailwind, and code Playground

HTML

<script>
_location = 'https://example.com/search?q=xss#%0aalert(document.domain)'
eval(unescape(_location))
</script>









<pre>
Using unescape(location) instead of location.hash.slice(1)

Why it works:

<b>https:</b> This is seen as a label

<b>//</b> this is the beginning of a js comment

<b>example.com/search?q=xss#</b> that part is still inside the comment

<b>%0a</b> Unescape will convert it to a new line, 
    everything that follows is therefore not in 
    the line that was commented out
    
<b>alert(1)</b> the payload
</pre>