TC-005 - I2 String-to-code evaluation

eval with URL input

positive / contextual I4 supporting SQ1SQ2SQ3

Context profile

No restrictive Content Security Policy is present. A session-like cookie is readable by JavaScript.

Content Security Policy

No Content-Security-Policy header is sent.

Cookie	Type	HttpOnly	Secure	SameSite
`tc_session`	session-like	no	no	Lax

Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.

Test case

The script reads the input query parameter from location.search and passes it to eval, which executes the value as JavaScript. The value is code, not HTML.

Example runs

Query parameter

input = alert(document.cookie)

Script output

What to observe

Arithmetic shows eval returned: 42 under C0 - the string was executed as code, not shown as text.
Read document.cookie returns the JavaScript-readable cookie under C0, showing that the evaluated code runs with full page access.
alert(document.cookie) and Cookie exfiltration behave as in the I1 cases: under C0 they run (an alert, or a request to attacker.example in the Network tab); the cookie is a placeholder and the domain is non-routable.
Under C1 the restrictive CSP has no unsafe-eval, so eval throws EvalError (visible in the console) and nothing runs.

The static finding is the same in both profiles - the eval call on URL-derived input. The context decides the runtime impact: a CSP without unsafe-eval can block the execution, but not the finding.

Expected outcome

Purpose: Check whether string-to-code evaluation through eval is reported.
Expected finding: Finding on eval; where AST context is available, it should also show the nearby URL source.
Expected interpretation: Strong code-injection indicator when the input is attacker-controlled; a CSP without unsafe-eval can limit runtime impact.
Expected priority: High (C0)
Notes: Main positive case for I2.

Expected priority is shown for the active context profile. Other profiles for this case: C0, C1.