TC-001 - I1 Unsafe DOM content injection

DOM update via innerHTML with URL input

positive / contextual I4 supporting SQ1SQ2SQ3

Context profile

No restrictive Content Security Policy is present. A session-like cookie is readable by JavaScript.

Content Security Policy

No Content-Security-Policy header is sent.

Cookie	Type	HttpOnly	Secure	SameSite
`tc_session`	session-like	no	no	Lax

Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.

Test case

The script reads the input query parameter from location.search and assigns it to innerHTML, so the browser parses the value as HTML.

Example runs

Query parameter

No input parameter in the URL.

Script output

What to observe

Plain text is shown as-is in both context profiles.
HTML markup is parsed: the word renders bold, because innerHTML interprets the value as HTML rather than text. This is the difference with the safe textContent variant (TC-003).
alert(document.cookie): under C0 the injected onerror handler runs and an alert shows the JavaScript-readable cookie; under C1 the Content Security Policy blocks the inline handler, so nothing runs. (The alert blocks the page until dismissed.)
Cookie exfiltration: under C0 the handler sends the cookie to attacker.example, visible as a request in the browser's Network tab; under C1 the CSP blocks the handler, and its img-src/connect-src would block the request as well. attacker.example is a reserved, non-routable domain and the cookie is a placeholder.

In every case the static finding is identical - the assignment to innerHTML. Only the runtime effect differs between the context profiles.

Purpose: Check whether the detection layer reports unsafe DOM content injection through innerHTML.
Expected finding: Finding on the assignment to innerHTML; where AST context is available, it should also show the nearby URL source.
Expected interpretation: Possible DOM XSS indicator; more urgent when CSP is missing or weak.
Expected priority: High (C0)
Notes: Main positive case for I1 and useful as a contextual case for SQ2 and SQ3.

Expected priority is shown for the active context profile. Other profiles for this case: C0, C1.