Controlled test site Client-side JavaScript security indicators

Indicators
I2

I2 - sink

String-to-code evaluation

Strings that are executed as JavaScript code. Only the string form of timer APIs is in scope; the callback form is not.

TC-005 - positive / contextual eval with URL input Check whether string-to-code evaluation through eval is reported. C0C1
TC-006 - positive / contextual new Function with URL input Check whether the Function constructor is reported as string-to-code evaluation. C0C1
TC-007 - positive / contextual setTimeout with string argument Check that timer APIs are treated as I2 only when they execute a string as code. C0C1
TC-008 - negative setTimeout with callback function Check that normal callback-based timers are not reported as string-to-code evaluation. single run
TC-009 - lower-risk / ambiguous eval with hardcoded string Check how a technically correct eval finding is handled when no attacker-controlled input is visible. C0C1

Test pages for the proof-of-concept evaluation.