TC-004 - I1 Unsafe DOM content injection
innerHTML with hardcoded markup
Context profile
No restrictive Content Security Policy is present. A session-like cookie is readable by JavaScript.
Content Security Policy
No Content-Security-Policy header is sent.
Cookies
| Cookie | Type | HttpOnly | Secure | SameSite |
|---|---|---|---|---|
tc_session | session-like | no | no | Lax |
Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.
Test case
The script assigns a hardcoded HTML string to innerHTML. There is
no query parameter and no other input flow, so no attacker-controlled data reaches the sink.
Script output
What to observe
- The markup is parsed and rendered -
innerHTMLstill parses HTML, so the static finding oninnerHTMLis the same as in TC-001. - There is no
locationread and noinputparameter: the value is a fixed string literal in the source, visible in the served script.
The finding is technically correct, but lower-risk because no attacker-controlled input is visible. The context profiles change the expected priority without changing the static finding - this case helps separate a real false positive from a correct finding that simply deserves lower priority.
Expected outcome
- Purpose
- Check how a technically correct I1 finding is handled when no attacker-controlled input is visible.
- Expected finding
- Finding on the assignment to innerHTML.
- Expected interpretation
- Technically correct indicator, but lower-risk because no attacker-controlled input is visible.
- Expected priority
- Low to medium (C0)
- Notes
- Helps distinguish a false positive from a technically correct finding with lower priority.
Expected priority is shown for the active context profile. Other profiles for this case: C0, C1.