Controlled test site Client-side JavaScript security indicators

Indicators
I1

I1 - sink

Unsafe DOM content injection

Strings that are inserted into the DOM and parsed as HTML, so injected markup can become active content.

TC-001 - positive / contextual DOM update via innerHTML with URL input Check whether the detection layer reports unsafe DOM content injection through innerHTML. C0C1
TC-002 - positive / contextual DOM update via document.write with URL input Check whether the second supported DOM injection sink is reported separately. C0C1
TC-003 - negative Safe DOM update via textContent Check that similar DOM updates without HTML parsing are not reported as I1. single run
TC-004 - lower-risk / ambiguous innerHTML with hardcoded markup Check how a technically correct I1 finding is handled when no attacker-controlled input is visible. C0C1

Test pages for the proof-of-concept evaluation.