Got the idea from here: encodeURI()

    var url = getBaseURL() + "/Home/Index/";
    var encoded = encodeURI(url);
    location.href = decodeURI(encoded);

This removes the Checkmarx errors.