Controlled test site Client-side JavaScript security indicators

TC-004 - I1 Unsafe DOM content injection

innerHTML with hardcoded markup

lower-risk / ambiguous SQ1SQ3

Context profile

A restrictive Content Security Policy is present. Session-like cookies use HttpOnly, Secure and SameSite.

Content Security Policy

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'

Cookies

CookieTypeHttpOnlySecureSameSite
tc_sessionsession-likeyesyesStrict

Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.

Test case

The script assigns a hardcoded HTML string to innerHTML. There is no query parameter and no other input flow, so no attacker-controlled data reaches the sink.

Script output

What to observe

  • The markup is parsed and rendered - innerHTML still parses HTML, so the static finding on innerHTML is the same as in TC-001.
  • There is no location read and no input parameter: the value is a fixed string literal in the source, visible in the served script.

The finding is technically correct, but lower-risk because no attacker-controlled input is visible. The context profiles change the expected priority without changing the static finding - this case helps separate a real false positive from a correct finding that simply deserves lower priority.

Expected outcome

Purpose
Check how a technically correct I1 finding is handled when no attacker-controlled input is visible.
Expected finding
Finding on the assignment to innerHTML.
Expected interpretation
Technically correct indicator, but lower-risk because no attacker-controlled input is visible.
Expected priority
Low (C1)
Notes
Helps distinguish a false positive from a technically correct finding with lower priority.

Expected priority is shown for the active context profile. Other profiles for this case: C0, C1.