Controlled test site Client-side JavaScript security indicators

Indicator groups

Each indicator group contains the controlled test cases derived from the indicator definitions. Pick an indicator to see its patterns, then pick a context profile.

I1 - sink Unsafe DOM content injection 4 test cases Strings that are inserted into the DOM and parsed as HTML, so injected markup can become active content. innerHTMLdocument.write
I2 - sink String-to-code evaluation 5 test cases Strings that are executed as JavaScript code. Only the string form of timer APIs is in scope; the callback form is not. evalnew FunctionsetTimeout / setInterval with a string argument
I3 - source and sink Sensitive client-side storage access 4 test cases Browser storage access. Relevant both because it may expose sensitive values to JavaScript and because stored values can later influence behaviour. document.cookielocalStoragesessionStorage
I4 - source URL-derived input 3 test cases A common way for attacker-controllable data to enter browser JavaScript. Weak on its own, stronger near a dangerous sink. location.hashdocument.locationwindow.location.href

Test pages for the proof-of-concept evaluation.