"If a HTTP parameter named [invisible character] is passed ... All of this means, assuming the above JavaScript code was placed on a web server, reachable at host:8080, an attacker could sneak ...