TC-002 - I1 Unsafe DOM content injection

DOM update via document.write with URL input

positive / contextual I4 supporting SQ1SQ2

Context profile

No restrictive Content Security Policy is present. A session-like cookie is readable by JavaScript.

Content Security Policy

No Content-Security-Policy header is sent.

Cookie	Type	HttpOnly	Secure	SameSite
`tc_session`	session-like	no	no	Lax

Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.

Test case

The script reads the input query parameter from location.search and passes it to document.write, which parses the value as HTML.

Unlike innerHTML, document.write after the page has loaded replaces the whole document. Each example run below therefore navigates to a page that document.write rebuilds from your input; use the browser's back button to return. The default run (no input) leaves this page intact so it stays capturable.

Example runs

Query parameter

No input parameter in the URL.

What to observe

Plain text is written as-is in both context profiles.
HTML markup is parsed: document.write interprets the value as HTML, so the word renders bold.
alert(document.cookie): under C0 the injected onerror handler runs and an alert shows the JavaScript-readable cookie; under C1 the Content Security Policy blocks the inline handler, so nothing runs.
Cookie exfiltration: under C0 the handler sends the cookie to attacker.example, visible as a request in the browser's Network tab; under C1 the CSP blocks the handler and would block the request too. attacker.example is a reserved, non-routable domain and the cookie is a placeholder.

The static finding is the same in every case - the document.write call. Only the runtime effect differs between the context profiles, exactly as for innerHTML in TC-001; the two are kept as separate test cases so each sink can be evaluated independently.

Expected outcome

Purpose: Check whether the second supported DOM injection sink is reported separately.
Expected finding: Finding on document.write; where AST context is available, it should also show the nearby URL source.
Expected interpretation: Possible DOM XSS indicator; context determines whether the finding should be prioritised higher or interpreted more cautiously.
Expected priority: High (C0)
Notes: Kept separate from TC-001 so that innerHTML and document.write can be evaluated independently.

Expected priority is shown for the active context profile. Other profiles for this case: C0, C1.