TC-003 - I1 Unsafe DOM content injection

Safe DOM update via textContent

negative I4 supporting SQ1

Context profile

Single run. Browser context is not decisive for this test case, so no context profile is applied.

Content Security Policy

No Content-Security-Policy header is sent.

No cookies are set by this page.

Test case

The script reads the input query parameter from location.search and assigns it to textContent. Unlike innerHTML (TC-001), textContent sets the value as plain text, so any markup is shown literally and never parsed as HTML.

Example runs

Query parameter

No input parameter in the URL.

Script output

What to observe

HTML markup appears literally: you see the characters <strong>bold</strong>, not a bold word. No element is created.
Script payload is shown as text as well: the same <img onerror> that executes in TC-001 does nothing here, because no img element is ever created.

No I1 finding is expected: textContent does not parse HTML. A URL-derived source (I4) may still be reported, because the value is read from location.search; this is a negative case for I1, not necessarily for I4.

Expected outcome

Purpose: Check that similar DOM updates without HTML parsing are not reported as I1.
Expected finding: No unsafe DOM content injection finding. A URL-derived source may be reported if the query parameter is read through a supported source such as location.search.
Expected interpretation: Safe or lower-risk DOM update; no I1 finding expected.
Expected priority: None (single run)
Notes: Checks that the I1 indicator does not treat every DOM update as HTML injection. It is a negative case for I1, not necessarily for I4.