Complex sentence: In the DOM-based XSS the malicious data does not touch the web server and it's being reflected by the JavaScript code, fully on the client side.
Split into simpler sentences: In the DOM-based XSS, the malicious data does not touch the web server. Rather, it is being reflected by the JavaScript code, fully on the client side.